sast-orchestration

SAST Orchestration

This skill runs multiple static-analysis tools against a codebase, authors custom detection rules, ingests SARIF, and performs high-signal triage. The headline capability is triage: converting raw, noisy SAST output into a ranked list of exploitable findings — where frontier reasoning models outperform traditional tools.

When to Use

• Scan a codebase for security vulnerabilities (first-party or third-party).
• Write a custom Semgrep rule or CodeQL query from a CVE advisory, patch diff, or sink spec.
• Triage and rank a pile of SAST findings (SARIF or tool-native JSON) by exploitability.
• Reduce false-positive noise from existing scans.
• Integrate SAST into GitHub Actions / GitLab CI / Bitbucket Pipelines / Jenkins.
• Aggregate and deduplicate findings across multiple SAST tools.
• Decide which SAST tool(s) fit a given language/framework.

Trigger Phrases

• "scan this code for vulnerabilities"
• "write a Semgrep rule to detect ..."
• "write a CodeQL query for ..."
• "triage these SAST findings" / "rank these by exploitability"
• "convert this CVE into a detection rule"
• "set up SAST in CI" / "add security scanning to our pipeline"
• "reduce false positives in this scan"
• "aggregate SARIF from multiple tools"

When NOT to Use This Skill

• Dependency/package CVEs (SBOM, transitive vulns, license) → use sca-security.
• Runtime/dynamic testing (HTTP fuzzing, auth bypass, DAST) → use dast-automation.
• Container image scanning (OS packages, base image CVEs) → use container-security.
• IaC misconfiguration (Terraform, CloudFormation, Kubernetes YAML) → use iac-security.
• Mobile app binary scanning (APK, IPA) → use android-pentest / ios-pentest.
• LLM/prompt-injection scanning → use llm-security.
• Threat modeling (architecture-level risk analysis) → use threat-modeling.

SAST = source code static analysis. If the artifact is not source, check a sibling skill first.

Decision Tree

Incoming request
│
├── "write a rule"         → workflows/custom_semgrep_from_cve.md  (from CVE/advisory)
│                            workflows/custom_codeql_from_sink.md  (from sink spec)
│
├── "triage these findings"→ workflows/triage.md                   [MAX THINKING]
│
├── "scan this codebase"   → workflows/multi_tool_scan.md          (parallel fan-out)
│                            then workflows/triage.md
│
├── "too much noise"       → workflows/false_positive_reduction.md
│
├── "SAST in CI"           → workflows/cicd_integration.md
│
└── "which tool for X?"    → references/<tool>.md (selection matrix below)