utkusen/sast-skills

Health v2 · maintenance only

Flags: no_releases young

Adoption not part of the score

1289 stars · 62 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of LLM agent skills that turn coding assistants like Claude Code, Codex, Opencode, and Cursor into a SAST (static application security testing) scanner. It orchestrates codebase analysis, 13 parallel vulnerability detection skills, and consolidated severity-ranked reporting without third-party tools.

Use cases

• find vulnerabilities in my codebase with an LLM
• run a SAST scan using Claude Code
• detect SQL injection and XSS in my web app
• audit my mobile app for security flaws
• generate a security report with remediation guidance
• check for IDOR and SSRF in my API
• static security analysis without installing scanners

When to choose

• you already use an agent-skills-capable assistant like Claude Code or Cursor
• you want broad vulnerability coverage (SQLi, XSS, RCE, SSRF, JWT, business logic) in one workflow
• you prefer LLM-driven analysis with exploitability verification over regex-based scanners
• you need a consolidated severity-ranked report with remediation guidance

When to avoid

• you need deterministic, CI-enforced scanning with stable rule IDs and low false-positive guarantees
• you cannot send proprietary source code to an LLM provider
• you need compliance-certified SAST tooling
• you want fast scans on very large codebases with minimal token cost

Facets

framework · maturity active

security vulnerability-scanning agent-framework llm-inference developer-tools security developer-tools artificial-intelligence web-development mobile-development cli cross-platform python go rust jvm php ruby sast static-analysis claude-code agent-skills vulnerability-detection appsec code-scanning llm-security nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="utkusen/sast-skills")