testland/language-native-sast
Language-native SAST linters - the first-party "linter as SAST" family that runs inside each ecosystem's standard toolchain with no separate scanner server: Bandit (Python, 60+ B-rules, severity x confidence filtering), gosec (Go, 40+ G-rules, AST + SSA taint tracking, golangci-lint integration), eslint-plugin-security + eslint-plugin-no-unsanitized (JS/TS, 14 detect-* rules + DOM-sink XSS), and PMD's Apex security ruleset (Salesforce, ApexSOQLInjection / ApexCRUDViolation / ApexSharingViolations). Covers the shared adoption pattern - install as a dev dependency, first scan, suppression-with-justification discipline, baseline-diff adoption for legacy code, SARIF output + CI gating - with per-tool depth in references. Use when a repo needs in-toolchain security linting for Python, Go, JavaScript/TypeScript, or Apex; for cross-language or cross-file taint analysis use semgrep-rules / codeql-queries instead.
72
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill contains explicit runtime install/download steps that fetch and execute remote code (e.g., go install github.com/securego/gosec/v2/cmd/gosec@latest, pre-commit hook repo: https://github.com/PyCQA/bandit, and a curl to download PMD: https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-dist-${PMD_VERSION}-bin.zip), so these external URLs are runtime dependencies that pull and run remote code.
Where we found it
github.com/securego/gosec/v2/cmd/gosec
dependency · 3 sites
The plugin instructs `go install` to fetch and execute the gosec binary from a remote Go module at runtime.
SKILL.md
54
go install github.com/securego/gosec/v2/cmd/gosec@latest # Go
references/gosec.md
21
go install github.com/securego/gosec/v2/cmd/gosec@latest
27
go install github.com/securego/gosec/v2/cmd/gosec@v2.20.0
https://github.com/PyCQA/bandit
dependency · 1 site
The plugin's pre-commit config fetches and executes code from the PyCQA/bandit GitHub repository as a pre-commit hook.
references/bandit.md
154
- repo: https://github.com/PyCQA/bandit
curl -Lo pmd.zip https://github.[REDACTED]%2F${PMD_VERSION}/pmd-dist-${PMD_VERSION}-bin.zip
command · 2 sites
The plugin instructs curl to download a PMD zip from GitHub releases and then unzips and executes it, fetching remote code at runtime.
references/pmd-apex.md
203
curl -Lo pmd.zip \
references/pmd-apex.md
204
https://github.[REDACTED]%2F${PMD_VERSION}/pmd-dist-${PMD_VERSION}-bin.zip
bandit[toml]
dependency · 3 sites
The plugin instructs pip install to fetch the bandit package from PyPI, pulling and executing remote code at runtime.
SKILL.md
53
pip install bandit[toml] # Python
references/bandit.md
24
pip install bandit[toml]
173
- run: pip install bandit[toml]
eslint-plugin-security
dependency · 2 sites
The plugin instructs npm install to fetch eslint-plugin-security from the npm registry, pulling remote code at runtime.
SKILL.md
55
npm install --save-dev eslint-plugin-security eslint-plugin-no-unsanitized # JS/TS
references/eslint-security.md
23
npm install --save-dev eslint-plugin-security
eslint-plugin-no-unsanitized
dependency · 2 sites
The plugin instructs npm install to fetch eslint-plugin-no-unsanitized from the npm registry, pulling remote code at runtime.
SKILL.md
55
npm install --save-dev eslint-plugin-security eslint-plugin-no-unsanitized # JS/TS
references/eslint-security.md
24
npm install --save-dev eslint-plugin-no-unsanitized
@microsoft/eslint-formatter-sarif
dependency · 1 site
The plugin instructs npm install to fetch @microsoft/eslint-formatter-sarif from the npm registry, pulling remote code at runtime.
references/eslint-security.md
33
npm install --save-dev @microsoft/eslint-formatter-sarif
securego/gosec@master
dependency · 1 site
The plugin references the securego/gosec GitHub Action pinned to @master, a mutable ref that fetches and executes remote code.
references/gosec.md
172
- uses: securego/gosec@master
golangci/golangci-lint-action@v6
dependency · 1 site
The plugin references the golangci/golangci-lint-action GitHub Action, a third-party hosted actor that fetches and executes remote code.
references/gosec.md
190
- uses: golangci/golangci-lint-action@v6
github/codeql-action/upload-sarif@v3
dependency · 5 sites
The plugin references the github/codeql-action/upload-sarif GitHub Action across multiple CI workflow examples, fetching and executing remote code.
SKILL.md
109
- uses: github/codeql-action/upload-sarif@v3
references/bandit.md
175
- uses: github/codeql-action/upload-sarif@v3
references/eslint-security.md
198
- uses: github/codeql-action/upload-sarif@v3
references/gosec.md
175
- uses: github/codeql-action/upload-sarif@v3
references/pmd-apex.md
220
uses: github/codeql-action/upload-sarif@v3
- Audited
- Security analysis