sast-configuration

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/sast-configuration/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is actionable with good executable examples across the major SAST tools, but it is padded with generic best-practice content, lacks validation feedback loops in its workflow, and points to bundle files that are missing from the skill directory.

Suggestions

Add an explicit validate→fix→retry checkpoint in the workflow (e.g., run a baseline scan, review findings, tune suppressions, re-scan before gating).

Create the referenced bundle files (references/*.md, assets/*, scripts/run-sast.sh) or remove the broken links so navigation is not dead-ended.

Trim generic sections like Team Enablement and the more obvious Troubleshooting bullets that restate knowledge Claude already has, and move detailed tool comparison / rule authoring into the reference files.

Dimension	Reasoning	Score
Conciseness	The body is mostly structured with executable code, but sections like Team Enablement ("Provide security training for developers", "Establish security champions program") and Troubleshooting restate generic guidance Claude already knows and could be trimmed.	3 / 5
Actionability	Concrete, mostly copy-paste-ready commands and configs are provided for Semgrep, SonarQube, CodeQL, GitHub Actions, and pre-commit hooks, with only minor gaps such as partial CI snippets and reliance on bundled scripts.	4 / 5
Workflow Clarity	A clear 5-step sequence (Identify → Choose → Integrate → Tune → Track) is present, but there are no explicit validate→fix→retry checkpoints within the batch scanning workflow, which caps batch-operation workflows at 3.	3 / 5
Progressive Disclosure	Sections are clearly labeled and one-level-deep references are signaled, but all six referenced bundle files (references/semgrep-rules.md, sonarqube-config.md, codeql-setup.md, assets/semgrep-config.yml, sonarqube-settings.xml, scripts/run-sast.sh) do not exist, and substantial content that could live in separate files is inlined.	3 / 5
	Total	13 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A clear, well-structured description that explicitly answers both what the skill does and when to use it, with good trigger-term coverage. It is held back only by limited action specificity and minor overlap with adjacent security skills.

Suggestions

Expand the action list beyond a single 'Configure' verb to 2-3 specific actions (e.g., 'Configure SAST tools, create custom rules, and gate CI/CD pipelines on scan results').

Add common synonyms such as 'static analysis' or 'code scanning' alongside 'SAST' to broaden natural trigger coverage.

Dimension	Reasoning	Score
Specificity	"Configure Static Application Security Testing (SAST) tools" names the domain and one concrete action; "automated vulnerability detection" is the purpose rather than a second distinct action, so it lists only 1-2 concrete actions and is not comprehensive.	3 / 5
Completeness	It explicitly states the "what" ("Configure SAST tools for automated vulnerability detection in application code") and the "when" via a concrete "Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection" clause.	5 / 5
Trigger Term Quality	Natural trigger terms like "security scanning", "DevSecOps practices", and "automating code vulnerability detection" give good keyword coverage, though common synonyms such as "static analysis" or "code scanning" are missing.	4 / 5
Distinctiveness Conflict Risk	The SAST-tooling niche is mostly distinct with clear triggers, but there is minor overlap risk with closely related skills (DAST, dependency scanning, container security) that the skill itself lists as related.	4 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 6 missing, 3 suspicious	Warning
referenced_paths_exist	Referenced path issues: 7 missing	Warning

	Total	14 / 16 Passed

Repository: rmyndharis/antigravity-skills
Path: skills/sast-configuration/SKILL.md
Commit: 3eff4af

Reviewed: 21 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.