跳到主要内容
知知仓学习社ZHICANG

security-scanning-security-sast

Static Application Security Testing (SAST) for code vulnerability

执行命令严重 2 · 高危 0sickn33/agentic-awesome-skills

它会碰到什么

扫了多少2 个文本文件，15 KB
它会碰到什么执行命令
命中总数11 处
命中统计严重 2 · 高 0 · 中 0 · 低 0
逐条看命中（2 条严重或高危）
  • 严重 references/detailed-guide.md:198yaml-unsafe
    **VULNERABLE**: pickle.loads(), yaml.load() with untrusted data
  • 严重 references/detailed-guide.md:198deserialize-unsafe
    **VULNERABLE**: pickle.loads(), yaml.load() with untrusted data

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

SAST Security Plugin

Static Application Security Testing (SAST) for comprehensive code vulnerability detection across multiple languages, frameworks, and security patterns.

Detailed Guide

Read [the detailed guide](references/detailed-guide.md) before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.

Use this skill when

Use for code review security analysis, injection vulnerabilities, hardcoded secrets, framework-specific patterns, custom security policy enforcement, pre-deployment validation, legacy code assessment, and compliance (OWASP, PCI-DSS, SOC2).

Specialized tools: Use security-secrets.md for advanced credential scanning, security-owasp.md for Top 10 mapping, security-api.md for REST/GraphQL endpoints.

Do not use this skill when

  • You only need runtime testing or penetration testing
  • You cannot access the source code or build outputs
  • The environment forbids third-party scanning tools

Safety

  • Avoid uploading proprietary code to external services without approval.
  • Require review before enabling auto-fix or blocking releases.

Limitations

  • Use this skill only when the task clearly matches the scope described above.
  • Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
  • Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库sickn33/agentic-awesome-skills
星标★ 46,490
本站分层T1
该仓技能数6676
原文件路径skills/security-scanning-security-sast/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 6676 个技能

同名技能的其他版本

有 3 个不同仓库或目录里都有叫 security-scanning-security-sast 的技能。它们内容并不相同，别混用：