[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6G5YX4RH9ESE5MJE2VB7CHP":3,"skill-same:01M6G5YX4RH9ESE5MJE2VB7CHP":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":14,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":50,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M6G5YX4RH9ESE5MJE2VB7CHP","sast-configuration",null,"Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or aut...","reikiplanet\u002Fdaoskills","reikiplanet","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F96377599?v=4","01M6CVWCMD740YHQDK7E9QYBW4","Reiki Planet","01M6CVWCS4KXVA2CWFVJ43EAXK",0,"MIT","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fsast-configuration\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"sast","configuration","sast configuration","vulnerability","Security Testing","application","security scanning","community","up","scanning","use","configure","testing","Tools","detection","code","vulnerability detection","security","devsecops","application security","2026-11-10 10:12:30",false,"---\nname: sast-configuration\ndescription: \"Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or aut...\"\nrisk: unknown\nsource: community\n---\n\n# SAST Configuration\n\nStatic Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.\n\n## Use this skill when\n\n- Set up SAST scanning in CI\u002FCD pipelines\n- Create custom security rules for your codebase\n- Configure quality gates and compliance policies\n- Optimize scan performance and reduce false positives\n- Integrate multiple SAST tools for defense-in-depth\n\n## Do not use this skill when\n\n- You only need DAST or manual penetration testing guidance\n- You cannot access source code or CI\u002FCD pipelines\n- You need organizational policy decisions rather than tooling setup\n\n## Instructions\n\n1. Identify languages, repos, and compliance requirements.\n2. Choose tools and define a baseline policy.\n3. Integrate scans into CI\u002FCD with gating thresholds.\n4. Tune rules and suppressions based on false positives.\n5. Track remediation and verify fixes.\n\n## Safety\n\n- Avoid scanning sensitive repos with third-party services without approval.\n- Prevent leaks of secrets in scan artifacts and logs.\n\n## Overview\n\nThis skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.\n\n## Core Capabilities\n\n### 1. Semgrep Configuration\n- Custom rule creation with pattern matching\n- Language-specific security rules (Python, JavaScript, Go, Java, etc.)\n- CI\u002FCD integration (GitHub Actions, GitLab CI, Jenkins)\n- False positive tuning and rule optimization\n- Organizational policy enforcement\n\n### 2. SonarQube Setup\n- Quality gate configuration\n- Security hotspot analysis\n- Code coverage and technical debt tracking\n- Custom quality profiles for languages\n- Enterprise integration with LDAP\u002FSAML\n\n### 3. CodeQL Analysis\n- GitHub Advanced Security integration\n- Custom query development\n- Vulnerability variant analysis\n- Security research workflows\n- SARIF result processing\n\n## Quick Start\n\n### Initial Assessment\n1. Identify primary programming languages in your codebase\n2. Determine compliance requirements (PCI-DSS, SOC 2, etc.)\n3. Choose SAST tool based on language support and integration needs\n4. Review baseline scan to understand current security posture\n\n### Basic Setup\n```bash\n# Semgrep quick start\npip install semgrep\nsemgrep --config=auto --error\n\n# SonarQube with Docker\ndocker run -d --name sonarqube -p 9000:9000 sonarqube:latest\n\n# CodeQL CLI setup\ngh extension install github\u002Fgh-codeql\ncodeql database create mydb --language=python\n```\n\n## Reference Documentation\n\n- Semgrep Rule Creation - Pattern-based security rule development\n- SonarQube Configuration - Quality gates and profiles\n- CodeQL Setup Guide - Query development and workflows\n\n## Templates & Assets\n\n- semgrep-config.yml - Production-ready Semgrep configuration\n- sonarqube-settings.xml - SonarQube quality profile template\n- run-sast.sh - Automated SAST execution script\n\n## Integration Patterns\n\n### CI\u002FCD Pipeline Integration\n```yaml\n# GitHub Actions example\n- name: Run Semgrep\n  uses: returntocorp\u002Fsemgrep-action@v1\n  with:\n    config: >-\n      p\u002Fsecurity-audit\n      p\u002Fowasp-top-ten\n```\n\n### Pre-commit Hook\n```bash\n# .pre-commit-config.yaml\n- repo: https:\u002F\u002Fgithub.com\u002Freturntocorp\u002Fsemgrep\n  rev: v1.45.0\n  hooks:\n    - id: semgrep\n      args: ['--config=auto', '--error']\n```\n\n## Best Practices\n\n1. **Start with Baseline**\n   - Run initial scan to establish security baseline\n   - Prioritize critical and high severity findings\n   - Create remediation roadmap\n\n2. **Incremental Adoption**\n   - Begin with security-focused rules\n   - Gradually add code quality rules\n   - Implement blocking only for critical issues\n\n3. **False Positive Management**\n   - Document legitimate suppressions\n   - Create allow lists for known safe patterns\n   - Regularly review suppressed findings\n\n4. **Performance Optimization**\n   - Exclude test files and generated code\n   - Use incremental scanning for large codebases\n   - Cache scan results in CI\u002FCD\n\n5. **Team Enablement**\n   - Provide security training for developers\n   - Create internal documentation for common patterns\n   - Establish security champions program\n\n## Common Use Cases\n\n### New Project Setup\n```bash\n.\u002Fscripts\u002Frun-sast.sh --setup --language python --tools semgrep,sonarqube\n```\n\n### Custom Rule Development\n```yaml\n# See references\u002Fsemgrep-rules.md for detailed examples\nrules:\n  - id: hardcoded-jwt-secret\n    pattern: jwt.encode($DATA, \"...\", ...)\n    message: JWT secret should not be hardcoded\n    severity: ERROR\n```\n\n### Compliance Scanning\n```bash\n# PCI-DSS focused scan\nsemgrep --config p\u002Fpci-dss --json -o pci-scan-results.json\n```\n\n## Troubleshooting\n\n### High False Positive Rate\n- Review and tune rule sensitivity\n- Add path filters to exclude test files\n- Use nostmt metadata for noisy patterns\n- Create organization-specific rule exceptions\n\n### Performance Issues\n- Enable incremental scanning\n- Parallelize scans across modules\n- Optimize rule patterns for efficiency\n- Cache dependencies and scan results\n\n### Integration Failures\n- Verify API tokens and credentials\n- Check network connectivity and proxy settings\n- Review SARIF output format compatibility\n- Validate CI\u002FCD runner permissions\n\n## Related Skills\n\n- OWASP Top 10 Checklist\n- Container Security\n- Dependency Scanning\n\n## Tool Comparison\n\n| Tool | Best For | Language Support | Cost | Integration |\n|------|----------|------------------|------|-------------|\n| Semgrep | Custom rules, fast scans | 30+ languages | Free\u002FEnterprise | Excellent |\n| SonarQube | Code quality + security | 25+ languages | Free\u002FCommercial | Good |\n| CodeQL | Deep analysis, research | 10+ languages | Free (OSS) | GitHub native |\n\n## Next Steps\n\n1. Complete initial SAST tool setup\n2. Run baseline security scan\n3. Create custom rules for organization-specific patterns\n4. Integrate into CI\u002FCD pipeline\n5. Establish security gate policies\n6. Train development team on findings and remediation\n","# SAST Configuration\n\nStatic Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.\n\n## Use this skill when\n\n- Set up SAST scanning in CI\u002FCD pipelines\n- Create custom security rules for your codebase\n- Configure quality gates and compliance policies\n- Optimize scan performance and reduce false positives\n- Integrate multiple SAST tools for defense-in-depth\n\n## Do not use this skill when\n\n- You only need DAST or manual penetration testing guidance\n- You cannot access source code or CI\u002FCD pipelines\n- You need organizational policy decisions rather than tooling setup\n\n## Instructions\n\n1. Identify languages, repos, and compliance requirements.\n2. Choose tools and define a baseline policy.\n3. Integrate scans into CI\u002FCD with gating thresholds.\n4. Tune rules and suppressions based on false positives.\n5. Track remediation and verify fixes.\n\n## Safety\n\n- Avoid scanning sensitive repos with third-party services without approval.\n- Prevent leaks of secrets in scan artifacts and logs.\n\n## Overview\n\nThis skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.\n\n## Core Capabilities\n\n### 1. Semgrep Configuration\n- Custom rule creation with pattern matching\n- Language-specific security rules (Python, JavaScript, Go, Java, etc.)\n- CI\u002FCD integration (GitHub Actions, GitLab CI, Jenkins)\n- False positive tuning and rule optimization\n- Organizational policy enforcement\n\n### 2. SonarQube Setup\n- Quality gate configuration\n- Security hotspot analysis\n- Code coverage and technical debt tracking\n- Custom quality profiles for languages\n- Enterprise integration with LDAP\u002FSAML\n\n### 3. CodeQL Analysis\n- GitHub Advanced Security integration\n- Custom query development\n- Vulnerability variant analysis\n- Security research workflows\n- SARIF result processing\n\n## Quick Start\n\n### Initial Assessment\n1. Identify primary programming languages in your codebase\n2. Determine compliance requirements (PCI-DSS, SOC 2, etc.)\n3. Choose SAST tool based on language support and integration needs\n4. Review baseline scan to understand current security posture\n\n### Basic Setup\n```bash\n# Semgrep quick start\npip install semgrep\nsemgrep --config=auto --error\n\n# SonarQube with Docker\ndocker run -d --name sonarqube -p 9000:9000 sonarqube:latest\n\n# CodeQL CLI setup\ngh extension install github\u002Fgh-codeql\ncodeql database create mydb --language=python\n```\n\n## Reference Documentation\n\n- Semgrep Rule Creation - Pattern-based security rule development\n- SonarQube Configuration - Quality gates and profiles\n- CodeQL Setup Guide - Query development and workflows\n\n## Templates & Assets\n\n- semgrep-config.yml - Production-ready Semgrep configuration\n- sonarqube-settings.xml - SonarQube quality profile template\n- run-sast.sh - Automated SAST execution script\n\n## Integration Patterns\n\n### CI\u002FCD Pipeline Integration\n```yaml\n# GitHub Actions example\n- name: Run Semgrep\n  uses: returntocorp\u002Fsemgrep-action@v1\n  with:\n    config: >-\n      p\u002Fsecurity-audit\n      p\u002Fowasp-top-ten\n```\n\n### Pre-commit Hook\n```bash\n# .pre-commit-config.yaml\n- repo: https:\u002F\u002Fgithub.com\u002Freturntocorp\u002Fsemgrep\n  rev: v1.45.0\n  hooks:\n    - id: semgrep\n      args: ['--config=auto', '--error']\n```\n\n## Best Practices\n\n1. **Start with Baseline**\n   - Run initial scan to establish security baseline\n   - Prioritize critical and high severity findings\n   - Create remediation roadmap\n\n2. **Incremental Adoption**\n   - Begin with security-focused rules\n   - Gradually add code quality rules\n   - Implement blocking only for critical issues\n\n3. **False Positive Management**\n   - Document legitimate suppressions\n   - Create allow lists for known safe patterns\n   - Regularly review suppressed findings\n\n4. **Performance Optimization**\n   - Exclude test files and generated code\n   - Use incremental scanning for large codebases\n   - Cache scan results in CI\u002FCD\n\n5. **Team Enablement**\n   - Provide security training for developers\n   - Create internal documentation for common patterns\n   - Establish security champions program\n\n## Common Use Cases\n\n### New Project Setup\n```bash\n.\u002Fscripts\u002Frun-sast.sh --setup --language python --tools semgrep,sonarqube\n```\n\n### Custom Rule Development\n```yaml\n# See references\u002Fsemgrep-rules.md for detailed examples\nrules:\n  - id: hardcoded-jwt-secret\n    pattern: jwt.encode($DATA, \"...\", ...)\n    message: JWT secret should not be hardcoded\n    severity: ERROR\n```\n\n### Compliance Scanning\n```bash\n# PCI-DSS focused scan\nsemgrep --config p\u002Fpci-dss --json -o pci-scan-results.json\n```\n\n## Troubleshooting\n\n### High False Positive Rate\n- Review and tune rule sensitivity\n- Add path filters to exclude test files\n- Use nostmt metadata for noisy patterns\n- Create organization-specific rule exceptions\n\n### Performance Issues\n- Enable incremental scanning\n- Parallelize scans across modules\n- Optimize rule patterns for efficiency\n- Cache dependencies and scan results\n\n### Integration Failures\n- Verify API tokens and credentials\n- Check network connectivity and proxy settings\n- Review SARIF output format compatibility\n- Validate CI\u002FCD runner permissions\n\n## Related Skills\n\n- OWASP Top 10 Checklist\n- Container Security\n- Dependency Scanning\n\n## Tool Comparison\n\n| Tool | Best For | Language Support | Cost | Integration |\n|------|----------|------------------|------|-------------|\n| Semgrep | Custom rules, fast scans | 30+ languages | Free\u002FEnterprise | Excellent |\n| SonarQube | Code quality + security | 25+ languages | Free\u002FCommercial | Good |\n| CodeQL | Deep analysis, research | 10+ languages | Free (OSS) | GitHub native |\n\n## Next Steps\n\n1. Complete initial SAST tool setup\n2. Run baseline security scan\n3. Create custom rules for organization-specific patterns\n4. Integrate into CI\u002FCD pipeline\n5. Establish security gate policies\n6. Train development team on findings and remediation\n",{"name":5,"risk":44,"source":26,"description":7},"unknown","master","dff58085da947e81e8418c922055644bf0082b1b","skills\u002Fsecurity\u002Fsast-configuration","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills","https:\u002F\u002Fgithub.com\u002Freikiplanet","https:\u002F\u002Fwww.reiki-planet.com","Reiki Planet Game","2026-03-29 06:02:29",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add reikiplanet\u002Fdaoskills --skill sast-configuration",{"tool":59,"command":60},"bunx","bunx skills add reikiplanet\u002Fdaoskills --skill sast-configuration",{"tool":62,"command":63},"pnpm","pnpm dlx skills add reikiplanet\u002Fdaoskills --skill sast-configuration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fsast-configuration\u002FSKILL.md",true,[],[68,94,106,120,139,160],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":39},"01M6G614JTEQJHPT8AKK3YQ18S","web-games","Web browser game development principles. Framework selection, WebGPU, optimization, PWA.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fweb-games\u002FSKILL.md",[],[75,76,77,78,79,80,26,81,82,83,84,85,86,87,88,89,90,91,92,93],"games","web games","web","grep","principles","selection","framework selection","edit","write","read","pwa","game","web browser","game development","Optimization","framework","browser","development","webgpu",{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":39},"01M6G611H2YGV0GZFP90D38ZMJ","vr-ar","VR\u002FAR development principles. Comfort, interaction, performance requirements.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fvr-ar\u002FSKILL.md",[],[101,102,92,103,104,26,82,83,84,78,105,79],"ar","vr ar","interaction","requirements","performance",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":39},"01M6G60XNMHAMV1SV0EJ1CX0AY","templates","Project scaffolding templates for new applications. Use when creating new projects from scratch. Contains 12 templates for various tech stacks.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Ftemplates\u002FSKILL.md",[],[108,113,114,115,116,117,26,29,84,118,119,78],"project scaffolding","From Scratch","tech","project","scaffolding","projects","applications",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":39},"01M6G60T0GATMK3Q5H8GDC1Z8S","wcag-audit-patterns","Conduct WCAG 2.2 accessibility audits with automated testing, manual verification, and remediation guidance. Use when auditing websites for accessibility, fixing WCAG violations, or implementing ac...","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fwcag-audit-patterns\u002FSKILL.md",[],[127,128,129,130,131,26,132,133,134,135,29,136,137,138,31],"wcag audit patterns","wcag audit","patterns","WCAG","audit","manual","with","automated testing","guidance","remediation","verification","accessibility",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":39},"01M6G60PMCHW1FRZ63F931QK3R","vulnerability-scanner","Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fvulnerability-scanner\u002FSKILL.md",[],[146,147,22,148,149,150,151,152,26,84,78,153,79,154,155,156,157,36,158,159],"scanner","vulnerability scanner","prioritization","2025","mapping","chain","supply chain","Bash","analysis","risk","owasp","supply chain security","supply","advanced",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":39},"01M6G60JZBB8DK0W3DSG1WNMZK","threat-modeling-expert","Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use for security architecture r...","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fthreat-modeling-expert\u002FSKILL.md",[],[167,168,169,170,171,172,173,174,36,29,175,176,177,26,178,179,180,155,181,182],"modeling","threat modeling expert","threat modeling","expert","threat","risk assessment","architecture review","architecture","security architecture review","trees","security architecture","security requirement extraction","assessment","extraction","review","stride"]