Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
This collection of agent skills teaches an AI coding assistant to perform static application security testing across 15 vulnerability classes—SQL injection, cross-site scripting, remote code execution, server-side request forgery, template injection, XML external entities, path traversal, insecure file upload, hardcoded secrets, JWT flaws, IDOR, missing authentication, GraphQL injection, and business logic vulnerabilities. It helps application security engineers, devsecops teams, and security-conscious developers catch vulnerabilities earlier without leaving the development environment.
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
I’m using
Claude Code workspace bundle
Installs: Complete LLM SAST Skills toolkit workspace bundle; skillPaths is a bounded, evidence-supported subset of the skills included in the bundle. · Claude Code
Before you start
Claude Code or another AI coding assistant that supports agent skills.
A local project to place inside the toolkit workspace.
Before running the assessment, ensure the copied project does not contain CLAUDE.md or AGENTS.md, because either file would conflict with the toolkit's orchestration file.
Copy the project into the sast-files folder. Replace /path/to/your/project with the path to the project you want to assess; keep sast-files/ as the destination.
cp -r /path/to/your/project sast-files/
Before running an assessment, manually remove any CLAUDE.md or AGENTS.md file from the copied project if one exists, since it would conflict with the toolkit orchestration file.
Open sast-files as the workspace in Claude Code. The toolkit uses CLAUDE.md to orchestrate the assessment workflow for Claude Code.
Installs: Complete LLM SAST Skills toolkit workspace bundle; skillPaths is a bounded, evidence-supported subset of the skills included in the bundle. · Codex, Opencode, Cursor
Before you start
An AI coding assistant that supports agent skills, such as Codex, Opencode, or Cursor.
A local project to place inside the toolkit workspace.
Before running the assessment, ensure the copied project does not contain CLAUDE.md or AGENTS.md, because either file would conflict with the toolkit's orchestration file.
Copy the project into the sast-files folder. Replace /path/to/your/project with the path to the project you want to assess; keep sast-files/ as the destination.
cp -r /path/to/your/project sast-files/
Before running an assessment, manually remove any CLAUDE.md or AGENTS.md file from the copied project if one exists, since it would conflict with the toolkit orchestration file.
Open sast-files as the workspace in the AI coding assistant. The toolkit documents AGENTS.md as the orchestration entry point for Opencode and other IDEs.
Readable dependency manifests, configuration files, directory structure, and source code.
Use the sast-analysis skill to perform security-focused reconnaissance on the project in this workspace. Identify its technology stack, architecture, entry points, primary data flows, trust boundaries, privilege levels, and sensitive-data locations, then write the documented architecture summary to sast/architecture.md. Do not report specific vulnerabilities during this task.
An existing sast/architecture.md produced by sast-analysis.
Use the sast-idor skill on the project in this workspace. Confirm that sast/architecture.md exists, then perform the recon phase to identify candidate endpoints where user-supplied IDs, slugs, filenames, or similar identifiers access objects. For each candidate, note where an ownership or object-level authorization check should be verified; do not treat missing authentication, admin-function access, public resources, non-object parameter tampering, or SQL injection as IDOR.
Check for GraphQL operation-string injection candidates
Uses sast-graphql
A project copied into the sast-files workspace.
An existing sast/architecture.md produced by sast-analysis.
Use the sast-graphql skill on the project in this workspace. Confirm that sast/architecture.md exists, then perform the recon phase: determine whether the project uses GraphQL and identify locations where user input may alter a query, mutation, or subscription document through concatenation, interpolation, dynamic templates, forwarding, or unsafe document selection. If no GraphQL technology is present, report that and stop after recon. Do not classify SQL injection in resolvers, IDOR through static-document variables, normal variable binding, or introspection alone as GraphQL injection.
Claude
Codex
Cursor
OpenCode