# utkusen/sast-skills

Collection of agent skills to find vulnerabilities inside your web/mobile apps.

Repository: https://github.com/utkusen/sast-skills
Canonical: https://ross.abutalabs.com/products/sast-skills
License: MIT
License Family: permissive
Topics: ai-security, claude, claude-code, sast
Last push: 2026-04-08T14:45:56+00:00

## Health v2 (maintenance only)
Score: 49/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 76, release rhythm 35, longevity 11
- inputs: {"age_days": 156, "days_push": 147, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, young
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1289, forks 62 (observed 2026-08-28T04:04:15.314538+00:00)

## What it is
A collection of LLM agent skills that turn coding assistants like Claude Code, Codex, Opencode, and Cursor into a SAST (static application security testing) scanner. It orchestrates codebase analysis, 13 parallel vulnerability detection skills, and consolidated severity-ranked reporting without third-party tools.

## Use cases
- find vulnerabilities in my codebase with an LLM
- run a SAST scan using Claude Code
- detect SQL injection and XSS in my web app
- audit my mobile app for security flaws
- generate a security report with remediation guidance
- check for IDOR and SSRF in my API
- static security analysis without installing scanners

## When to choose
- you already use an agent-skills-capable assistant like Claude Code or Cursor
- you want broad vulnerability coverage (SQLi, XSS, RCE, SSRF, JWT, business logic) in one workflow
- you prefer LLM-driven analysis with exploitability verification over regex-based scanners
- you need a consolidated severity-ranked report with remediation guidance

## When to avoid
- you need deterministic, CI-enforced scanning with stable rule IDs and low false-positive guarantees
- you cannot send proprietary source code to an LLM provider
- you need compliance-certified SAST tooling
- you want fast scans on very large codebases with minimal token cost

## Facets
- artifact type: framework
- maturity: active
- function: security, vulnerability-scanning, agent-framework, llm-inference, developer-tools
- domain: security, developer-tools, artificial-intelligence, web-development, mobile-development
- platform: cli, cross-platform, python, go, rust, jvm, php, ruby
- tags: sast, static-analysis, claude-code, agent-skills, vulnerability-detection, appsec, code-scanning, llm-security, nodejs

## Member repositories
- utkusen/sast-skills (main) score 49

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:15.314538+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:55:46.772363+00:00, confidence not recorded.
  - readme: https://github.com/utkusen/sast-skills (fetched 2026-08-28T04:04:15.314538+00:00, sha 44a878da29c7)
- Data as of 2026-08-30T08:39:29.467469+00:00.