sast-configuration Skill (wshobson) for Claude: What It Does and How to Install It

Helps Claude set up static security scanning with Semgrep, SonarQube and CodeQL, including CI jobs, custom rules and quality gates.

Installs: 11K; on skills.sh
Stars: 42.1K; on GitHub
Updated: Oct 2026; last repo commit

This is a setup guide for Claude, from wshobson's agents collection. It covers three tools: Semgrep, SonarQube and CodeQL. It gives quick start commands, a GitHub Actions job, a pre-commit hook, a custom rule, a PCI-DSS scan, best practices, troubleshooting and a tool comparison table.

It loads when you set up security scanning or DevSecOps checks. It bundles no scripts, but its commands install packages, start a Docker container and add CI and pre-commit config. Check them before Claude runs them.

Good for

Developers adding SAST scans to a CI pipeline
Security engineers writing custom Semgrep rules
Teams tuning false positives and compliance scans

Install sast-configuration

Claude Code

Copy this prompt.

Install the sast-configuration skill in Claude Code. Run this command:

/plugin marketplace add wshobson/agents
/plugin install security-scanning@claude-code-workflows

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin routes install the whole security-scanning plugin: 2 agents, 3 commands and 5 skills (counted from the plugin folder in the repo tree, which has no hooks or MCP config files). The skills-only routes install just this skill, with no agents or commands. Depending on the tool you pick, the skill's commands need Python and pip, Docker or the GitHub CLI on your machine.

From the project README. Source.

What's in the skill

When it loads

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Sections in SKILL.md

Overview
Core Capabilities
1. Semgrep Configuration
2. SonarQube Setup
3. CodeQL Analysis
Quick Start
Initial Assessment
Basic Setup
Integration Patterns
CI/CD Pipeline Integration
Pre-commit Hook
Best Practices
Common Use Cases
New Project Setup
Custom Rule Development
Compliance Scanning

Key facts

Author: wshobson (repo owner)
License: MIT
Installs on skills.sh: 10,999 (Nov 2, 2026)
GitHub stars: 42,081 for the whole wshobson/agents repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
What it includes: 1 file: SKILL.md. The folder has no other files
Needs: Depends on the tool: Python and pip for Semgrep, Docker for SonarQube, GitHub CLI for CodeQL
Part of: The security-scanning plugin in wshobson/agents. Counted from the plugin folder: 2 agents, 3 commands and 5 skills
Works in: Claude Code, Codex CLI, Cursor, OpenCode, Antigravity CLI, GitHub Copilot and Pi, per the README. Skills-only installers ask which tool you use

What it includes

Custom rules, language rules, CI integration and tuning
Covers pattern-matching rules, GitHub Actions, GitLab CI and Jenkins, false positive tuning and policy enforcement.
Write · Semgrep configuration
Quality gates, security hotspots, profiles and LDAP/SAML
Covers quality gates, hotspot analysis, coverage and debt tracking, custom quality profiles and enterprise sign-in.
Write · SonarQube setup
GitHub Advanced Security, custom queries and SARIF
Covers custom queries, variant analysis and processing SARIF results.
Write · CodeQL analysis
pip install semgrep, a SonarQube container and the CodeQL CLI
The quick start runs semgrep --config=auto --error, docker run for sonarqube:10.8-community, and gh extension install github/gh-codeql with codeql database create.
Try: “Set up Semgrep in our repo and add it to GitHub Actions.”
Runs code · Basic setup commands
Runs returntocorp/semgrep-action with p/security-audit and p/owasp-top-ten
An example CI step you can add to a workflow file.
Write · GitHub Actions job
A .pre-commit-config.yaml entry for Semgrep
Uses the semgrep repo at rev v1.45.0 with --config=auto and --error.
Write · Pre-commit hook
hardcoded-jwt-secret rule for jwt.encode
A Semgrep rule that flags a hard-coded JWT secret as an ERROR.
Write · Custom rule example
semgrep --config p/pci-dss --json -o pci-scan-results.json
Runs a PCI-DSS focused scan and writes the results to a JSON file.
Runs code · Compliance scan
Baseline first, tune false positives, speed up scans
Five best practice groups and three troubleshooting areas: false positives, performance and integration failures.
Read · Best practices and troubleshooting

From the official docs

Permissions

Medium risk

The main risk is that the setup commands install software, start a server and add checks that can block your pushes. Read each command first and try the CI changes on a branch.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It installs packages and starts a container
SKILL.md runs pip install semgrep, docker run for SonarQube and gh extension install github/gh-codeql. Check each command, and run them in a virtual environment or a dev machine you trust. github.com
The SonarQube example turns off a startup check
The second docker run example sets SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true. SKILL.md says this is for a local try-out and a real deployment needs vm.max_map_count>=524288 and fs.file-max>=131072 on the host instead. github.com
It changes CI and commit hooks
The GitHub Actions and pre-commit examples add steps that run on every push or commit and can fail them (--error). Introduce blocking rules gradually, as the best practices section says. github.com
The plugin route installs more than this skill
The security-scanning plugin has 5 skills, 2 agents and 3 commands. The repo tree shows no hooks or MCP config files in its folder. The skills-only routes install only this skill. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. Use version control.
Talks to	Package, image and extension downloads from the pip, docker and gh commands. Whatever your CI provider or SonarQube server connects to
Scopes	The quick start installs Semgrep with pip install and runs scans against your code It starts a SonarQube Docker container (sonarqube:10.8-community) and publishes port 9000 It installs the GitHub CLI extension github/gh-codeql and creates a CodeQL database It adds a GitHub Actions step and a .pre-commit-config.yaml entry to your repo The PCI-DSS example writes pci-scan-results.json

Questions

What does the sast-configuration skill do?

It guides Claude through setting up static application security testing. Claude uses it to choose between Semgrep, SonarQube and CodeQL, add scans to CI and write custom rules.

How do I install sast-configuration?

Use the install box at the top of this page. It lists the plugin route and two skills-only commands: npx skills add wshobson/agents --skill sast-configuration and gh skill install wshobson/agents sast-configuration (GitHub CLI 2.90 or later). The skills-only commands skip the plugin's agents and commands.

Which tools does it cover?

Three: Semgrep, SonarQube and CodeQL. A comparison table lists best use, language support, cost and integration for each.

Does it run the scanners for me?

It gives Claude the commands, and Claude can run them if you allow it. They install Semgrep with pip, start a SonarQube Docker container and set up the CodeQL CLI. The skill itself bundles no scripts.

Does it need an API key?

SKILL.md names none for the Semgrep, SonarQube or CodeQL commands. Its troubleshooting list says to verify API tokens and credentials for integrations, so a CI setup on your side may need them.

Are there related skills?

SKILL.md links two skills in the same plugin: stride-analysis-patterns and threat-mitigation-mapping. They are optional and not needed to use this one.

Is it safe?

Installing it adds a guide and no scripts. The commands in it do more: they install packages, start a container that listens on port 9000 and add files to your repo. Read each command before Claude runs it, and use a branch for CI and pre-commit changes.

Is this skill from Anthropic?

No. It is in wshobson/agents, a community collection. The skill sits in the security-scanning plugin there.

Should I install the whole security-scanning plugin?

Only if you want the rest. The README documents a plugin route for Claude Code and Codex. The plugin folder holds 5 skills, 2 agents and 3 commands, and the repo tree shows no hooks or MCP config files in it.

Information

updated Nov 2, 2026

Repository: wshobson/agents
Folder: plugins/security-scanning/skills/sast-configuration

wshobson/agents skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3

sast-configuration SKILL.md · github.com
wshobson/agents README · github.com
security-scanning plugin.json · github.com