Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    sast configuration governance

    1

    Plan, configure, and govern SAST programmes with scanner-agnostic designs and CI/CD quality gates.

    $15

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    sast configuration governance

    sast configuration governance

    Example session with this skill installed

    I need to roll out SAST for a TypeScript and Go project using GitHub Actions. We want to start with advisory warnings and move to blocking PRs for high-severity issues in 3 months.

    • Read your context and instructions
    • Compiled the sast configuration governance

    I have designed a phased SAST rollout plan for your TypeScript and Go project. The strategy focuses on establishing a baseline before moving to active enforcement.

    SAST Implementation Plan: GitHub Actions

    PhaseDurationEnforcement ModeObjective
    Phase 1: BaselineWeeks 1-4Advisory (Non-blocking)Identify existing vulnerabilities and suppress legacy technical debt.
    Phase 2: TriageWeeks 5-8Warning (PR Comment)Educate developers on new findings without stopping the build.
    Phase 3: EnforcementMonth 3+Blocking (Hard Gate)Block PRs containing new High/Critical vulnerabilities.

    Technical Configuration Design

    
# GitHub Actions Workflow Snippet (Phase 1/2)
name: Security Scan
on:
  pull_request:
    branches: [main]
jobs:
  sast_scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Initialize Scanner
        # Placeholder for chosen tool (e.g., CodeQL or Semgrep)
        run: echo "Initializing scan for TypeScript/Go..."
      - name: Perform Analysis
        # Continue on error during advisory phases
        continue-on-error: true
        run: |
          scan-tool --severity high --format sarif --output results.sarif
      - name: Upload Results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif

    Quality Gate Policy

    • Critical/High: Must be remediated or formally suppressed with a documented false-positive reason before Phase 3.
    • Medium/Low: Logged for technical debt backlog; no blocking enforcement planned.
    • SLA: 14 days for Critical, 30 days for High findings post-Phase 3.

    Next steps

    1. Select a specific scanner (Semgrep or CodeQL recommended) to generate the final workflow syntax.
    2. Define the formal exception process for business-critical overrides.
    3. Run an initial baseline scan to quantify the current vulnerability backlog.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Design a phased SAST rollout strategy from advisory to blocking modes.Create quality gate policies based on severity and remediation SLAs.Develop false-positive suppression and governance workflows.Draft developer guidance for triaging and fixing security findings.

    About this skill

    The problem

    Integrating Static Application Security Testing (SAST) often fails due to high false-positive rates, broken CI/CD pipelines, or lack of clear enforcement policies. Security teams struggle to define meaningful quality gates without disrupting developer velocity.

    What it does

    • Generates scanner-agnostic SAST implementation plans for new or existing repositories.
    • Defines quality gate policies and severity thresholds based on risk tolerance and rollout stage.
    • Designs CI/CD integration workflows for tools like GitHub Actions, GitLab CI, or Jenkins.
    • Drafts governance rules for false-positive handling, suppression workflows, and remediation SLAs.
    • Produces developer-facing guidance and executive maturity reports for security programmes.

    Frameworks & tools

    Supports configuration design for Semgrep, SonarQube, CodeQL, and GitHub Advanced Security. Compatible with standard CI/CD platforms and SARIF-compliant reporting tools.

    Why this beats prompting it yourself

    General-purpose models often hallucinate scanner commands or recommend "blocking" gates that break production builds immediately. This skill enforces a phased rollout approach and insists on false-positive governance, preventing the common pitfalls of automated security tooling.

    Use cases

    • Rollout SAST for a polyglot microservices portfolio with phased enforcement.
    • Migrate from a legacy security scanner to a modern, developer-centric tool.
    • Audit existing SAST configurations to reduce noise and improve signal-to-noise ratios.
    • Standardize security quality gates across multiple engineering squads.

    Known limitations

    Cannot execute live API calls to your security platform or push configuration files directly to your VCS. It requires the user to specify the target scanner for tool-specific syntax.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean today

    • Passed all security checks, Safe to install

    Listedtoday

    Frequently Asked Questions