agentmods.dev

sast-dast-security-pipelines

sast-dast-security-pipelines is a skill for Claude Code, Codex from hamzabellouch/agent-skills. It costs 52 tokens per session (2,413 once invoked), scanned A, original, MIT.

A set of patterns for adding automated security checks to build and deployment pipelines. It covers code scanning, live-application testing, third-party dependency checks, secret detection, and SARIF reports, a standard format for security findings.

In plain words
What is it for?
Use it to design CI/CD security gates, combine scanner results, enforce remediation deadlines, manage approved false positives, and send findings to systems such as GitHub Security or DefectDojo.
Why use it?
It helps teams find security problems before release and automatically stop builds that exceed defined vulnerability limits or leave issues unresolved too long.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

not rated 8repo 22d ago A scan 52 tokens original MIT

Good fit Use it to design CI/CD security gates, combine scanner results, enforce remediation deadlines, manage approved false positives, and send findings to systems such as GitHub Security or DefectDojo.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/hamzabellouch/agent-skills/sast-dast-security-pipelines
View source ↗ hamzabellouch/agent-skills hamzabellouch.github.io
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add hamzabellouch/agent-skills --skill sast-dast-security-pipelines
Clone the repo
git clone --depth 1 https://github.com/hamzabellouch/agent-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for sast-dast-security-pipelines

README.md
[![agentmods](https://agentmods.dev/badge/skills/hamzabellouch/agent-skills/sast-dast-security-pipelines/github.svg)](https://agentmods.dev/skills/hamzabellouch/agent-skills/sast-dast-security-pipelines)
Your own site
<a href="https://agentmods.dev/skills/hamzabellouch/agent-skills/sast-dast-security-pipelines"><img src="https://agentmods.dev/badge/skills/hamzabellouch/agent-skills/sast-dast-security-pipelines/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for sast-dast-security-pipelines

Your own site · 80×15
<a href="https://agentmods.dev/skills/hamzabellouch/agent-skills/sast-dast-security-pipelines"><img src="https://agentmods.dev/badge/skills/hamzabellouch/agent-skills/sast-dast-security-pipelines.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,413 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00052 $0.02413
Opus 5.5 $0.00021 $0.00965
Sonnet 5.5 $0.00010 $0.00483
Haiku 4.5 $0.00005 $0.00241

Measured 2mo ago against content hash 01b86e733e41, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

sast-dast-security-pipelines scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

DevSecOps and Supply Chain Security/sast-dast-security-pipelines/SKILL.md · 259 lines

How it starts

The opening of the file, as written. The whole thing — 259 lines — stays where its author put it; the contents beside it link to each section on GitHub.

SAST & DAST Automated Security Pipelines

Overview

This skill defines production patterns for orchestrating automated SAST, DAST, SCA, and Secret Scanning engines inside CI/CD workflows. It establishes strict vulnerability SLA enforcement, standardized SARIF (Static Analysis Results Interchange Format) ingestion into GitHub Security Hub/DefectDojo, and automated deployment blocking for non-compliant security builds.

1. DevSecOps Pipeline Architecture & Principles

  1. Shift-Left Continuous Analysis: Execute fast, lightweight SAST and Secret Scanning on every pull request; defer heavy DAST and full dynamic fuzzing to staging environment deployment gates.
  2. Standardized SARIF Telemetry: All scanners (Semgrep, Trivy, Bandit, OWASP ZAP) must output findings formatted in standard SARIF v2.1.0 to enable centralized triage and correlation.
  3. Zero Security Debt SLA Enforcement: Fail builds automatically if open vulnerabilities breach SLA time-to-remediate windows:
    • Critical: 0-day SLA (Immediate block)
    • High: 7-day SLA
    • Medium: 30-day SLA
  4. Governed False Positive Exclusions: Code inline suppressions (#nosec, //nolint) require peer security architect code review and mandatory expiry annotations.

2. Security Pipeline Scanning Matrix & Quality Gates

Pipeline Stage Security Scanner Target Focus Gate Action
Commit / PR Trufflehog / Gitleaks Hardcoded API keys, RSA keys, AWS access tokens Block Commit
PR Build Semgrep / SonarQube Code injection, XSS, insecure deserialization, cryptographic weaknesses Block PR Merge if High/Critical
Artifact Build Trivy / Grype Base image OS packages, application lockfiles Block Image Push if High/Critical
Deploy Staging OWASP ZAP / Nuclei Runtime headers, CORS misconfiguration, SQLi, Auth bypass, SSRF Block Prod Deployment

3. Anti-Patterns & Risk Vectors

  • Anti-Pattern: Ignoring DAST Authentication State
    • Risk: DAST scanners running without valid session tokens or API auth headers test only unauthenticated public splash screens, missing internal microservice vulnerabilities.
    • Remediation: Pass ephemeral OAuth/Bearer tokens or OpenAPI/Swagger definitions to DAST engine scans.
  • Anti-Pattern: Silent / Non-Blocking CI Security Jobs (continue-on-error: true)
    • Risk: Security scans run purely as cosmetic checks while critical findings flow into production unnoticed.
    • Remediation: Enforce hard build failures on critical findings unless an explicit, signed security waiver exists.
  • Anti-Pattern: Monolithic Unfiltered Scanning
    • Risk: Scanning third-party vendor code (node_modules/, vendor/) generates massive noise and inflates CI execution time.
    • Remediation: Scope path configurations to first-party source files using explicit include/exclude patterns.

Read the full file on GitHub · 259 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 259 lines · 52 tokens per session scan A 01b86e733e41

Subscribe to this mod's changes

sast-dast-security-pipelines is a skill published in the GitHub repository hamzabellouch/agent-skills (8 stars, last pushed 22d ago), licensed MIT. It adds 52 tokens to every session and 2,413 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

CI and CDClaude CodeDevOps and cloudSecurityagent-skillsai-agentantigravitycodex-clicursor
Related

sast-dast-security-pipelines compared with skills from other repositories

sast-dast-security-pipelines next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
sast-dast-security-pipelineshamzabellouch/agent-skillsSkill822d agoMITA52Claude Code, Codex
ci-cd-and-automationaddyosmani/agent-skillsSkill114k6d agoMITA45Claude Code
tdd-configure-ciGulajavaMinistudio/awesome-copilot-idSkill9311d agoMITA33Claude Code, Codex
ci-cd-pipelinesDevelopersGlobal/ai-agent-skillsSkill21711d agoMITA33Claude Code, Codex
ci-cd-and-automationvinvcn/addyosmani-agent-skills-zhSkill4719d agoMITA46Claude Code
gitlab-ci-patternssawrus/agent-guidesSkill195d agoMITA58Claude Code, Codex
circleciG1Joshi/Agent-SkillsSkill151mo agoMITA39Claude Code, Codex