SAST Skills is a collection of agent workflows that inspect web and mobile application code for security vulnerabilities, where SAST means static application security testing. Developers and security reviewers use it to map a codebase, verify possible flaws, and produce a severity-ranked remediation report. The catalogue entries are the project's vulnerability-detection and reporting skills.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add utkusen/sast-skills --skill sast-analysisgit clone --depth 1 https://github.com/utkusen/sast-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/utkusen/sast-skills/sast-analysis)<a href="https://agentmods.dev/skills/utkusen/sast-skills/sast-analysis"><img src="https://agentmods.dev/badge/skills/utkusen/sast-skills/sast-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/utkusen/sast-skills/sast-analysis"><img src="https://agentmods.dev/badge/skills/utkusen/sast-skills/sast-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.00897 |
| Opus 5 | $0.00036 | $0.00449 |
| Sonnet 5 | $0.00015 | $0.00179 |
| Haiku 4.5 | $0.00007 | $0.00090 |
Grade A, and why
sast-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- sast-analysis — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codebase Analysis
You are performing the first phase of a security assessment. Your goal is to deeply understand the codebase. You are NOT looking for specific vulnerabilities yet. This is pure reconnaissance.
Create a sast/ folder in the project root (if it doesn't already exist). This phase produces one output file inside it:
sast/architecture.md — technology stack, architecture, entry points, data flows
Phase 1: Technology Reconnaissance
Explore the codebase and identify:
- Languages: All programming languages used and their versions if specified
- Frameworks: Web frameworks, ORM layers, template engines, task queues
- Package managers & dependencies: Lock files, dependency manifests (package.json, requirements.txt, go.mod, Gemfile, pom.xml, etc.)
- Infrastructure hints: Dockerfiles, docker-compose, Kubernetes manifests, Terraform, CI/CD configs
- Databases: SQL, NoSQL, cache layers, message brokers — look at connection strings, ORM models, migration files
- Authentication & authorization: Auth libraries, middleware, session configs, OAuth/OIDC providers, JWT usage, API key patterns
- External integrations: Third-party APIs, payment processors, email services, cloud SDKs, webhook handlers
- Entry points: HTTP routes, GraphQL schemas, gRPC service definitions, CLI commands, WebSocket handlers, scheduled jobs, message consumers
Start by reading dependency manifests, project configs, and directory structure. Then drill into source code to confirm findings.
Phase 2: Architecture Mapping
Based on Phase 1, build a mental model of:
- Service boundaries: Is this a monolith or microservices? What talks to what?
- Data flow: How does user input enter the system, get processed, get stored, and get returned?
- Trust boundaries: Where does the system transition between trusted and untrusted contexts? (e.g., user input -> backend, backend -> database, service -> service, server -> client)
- Privilege levels: What roles/permissions exist? How are they enforced? Is there an admin panel?
- Sensitive data inventory: PII, credentials, tokens, financial data, health records — where is each stored and how does it move?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 92 lines · 73 tokens per session scan A b2f526b6b6f5
sast-analysis is a skill published in the GitHub repository utkusen/sast-skills (1,307 stars, last pushed 5mo ago), licensed MIT. It adds 73 tokens to every session and 897 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
secure-code-review
Performs a structured security code review against OWASP ASVS 4.0.3 verification requirements and CWE Top 25. Auto-invoked on pull request reviews, when code touching authentication, authorization, cryptography, or input handling is shared. Produces findings mapped to ASVS controls and CWE identifiers with severity…
sast-config
Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows. Produces a SAST maturity assessment covering rule authoring, severity tuning, custom rule development, and CI…
eresus-manual-security-audit
Elite manual security code review skill for deep, adversarial vulnerability hunting and exploit-chain discovery. Trigger when the user asks to: "do a deep security audit", "manual code review", "find exploit chains", "hunt for logic bugs", "red-team this codebase", "do an offensive security review", "review this like…
eresus-php-audit
Deep PHP-specific security audit skill covering injection, deserialization, file operations, auth bypass, POP chain discovery, and CMS-specific patterns. Trigger when auditing PHP code: "audit this PHP app", "find PHP security issues", "check Laravel/WordPress for vulnerabilities", "PHP SAST review", "check for PHP…
eresus-sast-scanner
General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis. Trigger when the user asks to: "analyze code for vulnerabilities", "review code security", "find security bugs", "do a SAST scan", "check for [vulnerability type] in code", "audit source code", or requests a security code…
eresus-python-audit
Deep Python-specific security audit skill with 50+ vulnerability class coverage across 7 categories. Trigger when auditing Python code: "audit this Python app", "find Python security issues", "check Flask/Django for vulnerabilities", "Python SAST review", "check for pickle vulnerabilities", "review this FastAPI code".…