PaperclipOrg
Claude Agent Skill · by Wshobson

Sast Configuration

Takes the pain out of setting up SAST tools like Semgrep, SonarQube, and CodeQL in your CI/CD pipeline. Generates ready-to-use config files, pre-commit hooks, a

Install
Terminal · npx
$npx skills add https://github.com/wshobson/agents --skill sast-configuration
Works with Paperclip

How Sast Configuration fits into a Paperclip company.

Sast Configuration drops into any Paperclip agent that handles this kind of work. Assign it to a specialist inside a pre-configured PaperclipOrg company and the skill becomes available on every heartbeat — no prompt engineering, no tool wiring.

S
SaaS FactoryPaired

Pre-configured AI company — 18 agents, 18 skills, one-time purchase.

$27$59
Explore pack
Source file
SKILL.md204 lines
Expand
---name: sast-configurationdescription: Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.--- # SAST Configuration Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages. ## Overview This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL. Use this skill when you need to: - Set up SAST scanning in CI/CD pipelines- Create custom security rules for your codebase- Configure quality gates and compliance policies- Optimize scan performance and reduce false positives- Integrate multiple SAST tools for defense-in-depth ## Core Capabilities ### 1. Semgrep Configuration - Custom rule creation with pattern matching- Language-specific security rules (Python, JavaScript, Go, Java, etc.)- CI/CD integration (GitHub Actions, GitLab CI, Jenkins)- False positive tuning and rule optimization- Organizational policy enforcement ### 2. SonarQube Setup - Quality gate configuration- Security hotspot analysis- Code coverage and technical debt tracking- Custom quality profiles for languages- Enterprise integration with LDAP/SAML ### 3. CodeQL Analysis - GitHub Advanced Security integration- Custom query development- Vulnerability variant analysis- Security research workflows- SARIF result processing ## Quick Start ### Initial Assessment 1. Identify primary programming languages in your codebase2. Determine compliance requirements (PCI-DSS, SOC 2, etc.)3. Choose SAST tool based on language support and integration needs4. Review baseline scan to understand current security posture ### Basic Setup ```bash# Semgrep quick startpip install semgrepsemgrep --config=auto --error # SonarQube with Dockerdocker run -d --name sonarqube -p 9000:9000 sonarqube:latest # CodeQL CLI setupgh extension install github/gh-codeqlcodeql database create mydb --language=python``` ## Reference Documentation - [Semgrep Rule Creation](references/semgrep-rules.md) - Pattern-based security rule development- [SonarQube Configuration](references/sonarqube-config.md) - Quality gates and profiles- [CodeQL Setup Guide](references/codeql-setup.md) - Query development and workflows ## Templates & Assets - [semgrep-config.yml](assets/semgrep-config.yml) - Production-ready Semgrep configuration- [sonarqube-settings.xml](assets/sonarqube-settings.xml) - SonarQube quality profile template- [run-sast.sh](scripts/run-sast.sh) - Automated SAST execution script ## Integration Patterns ### CI/CD Pipeline Integration ```yaml# GitHub Actions example- name: Run Semgrep  uses: returntocorp/semgrep-action@v1  with:    config: >-      p/security-audit      p/owasp-top-ten``` ### Pre-commit Hook ```bash# .pre-commit-config.yaml- repo: https://github.com/returntocorp/semgrep  rev: v1.45.0  hooks:    - id: semgrep      args: ['--config=auto', '--error']``` ## Best Practices 1. **Start with Baseline**   - Run initial scan to establish security baseline   - Prioritize critical and high severity findings   - Create remediation roadmap 2. **Incremental Adoption**   - Begin with security-focused rules   - Gradually add code quality rules   - Implement blocking only for critical issues 3. **False Positive Management**   - Document legitimate suppressions   - Create allow lists for known safe patterns   - Regularly review suppressed findings 4. **Performance Optimization**   - Exclude test files and generated code   - Use incremental scanning for large codebases   - Cache scan results in CI/CD 5. **Team Enablement**   - Provide security training for developers   - Create internal documentation for common patterns   - Establish security champions program ## Common Use Cases ### New Project Setup ```bash./scripts/run-sast.sh --setup --language python --tools semgrep,sonarqube``` ### Custom Rule Development ```yaml# See references/semgrep-rules.md for detailed examplesrules:  - id: hardcoded-jwt-secret    pattern: jwt.encode($DATA, "...", ...)    message: JWT secret should not be hardcoded    severity: ERROR``` ### Compliance Scanning ```bash# PCI-DSS focused scansemgrep --config p/pci-dss --json -o pci-scan-results.json``` ## Troubleshooting ### High False Positive Rate - Review and tune rule sensitivity- Add path filters to exclude test files- Use nostmt metadata for noisy patterns- Create organization-specific rule exceptions ### Performance Issues - Enable incremental scanning- Parallelize scans across modules- Optimize rule patterns for efficiency- Cache dependencies and scan results ### Integration Failures - Verify API tokens and credentials- Check network connectivity and proxy settings- Review SARIF output format compatibility- Validate CI/CD runner permissions ## Related Skills - [OWASP Top 10 Checklist](../owasp-top10-checklist/SKILL.md)- [Container Security](../container-security/SKILL.md)- [Dependency Scanning](../dependency-scanning/SKILL.md) ## Tool Comparison | Tool      | Best For                 | Language Support | Cost            | Integration   || --------- | ------------------------ | ---------------- | --------------- | ------------- || Semgrep   | Custom rules, fast scans | 30+ languages    | Free/Enterprise | Excellent     || SonarQube | Code quality + security  | 25+ languages    | Free/Commercial | Good          || CodeQL    | Deep analysis, research  | 10+ languages    | Free (OSS)      | GitHub native | ## Next Steps 1. Complete initial SAST tool setup2. Run baseline security scan3. Create custom rules for organization-specific patterns4. Integrate into CI/CD pipeline5. Establish security gate policies6. Train development team on findings and remediation