Sast
Integrates SAST/DAST tooling into the SDLC — Semgrep rules, CodeQL, OWASP ZAP, and secure code review covering the full OWASP Top 10. Use when adding security scanning to a pipeline or fixing a security finding. Trigger with \"set up SAST scanning\", \"fix this security finding\".
- Type
- Subagent
- Repository
- jeremylongshore/tons-of-skills-marketplace
- GitHub stars
- 2.8k
- License
- MIT
- Repo last updated
- Sep 27, 2026
- Source file
- plugins/ai-agency/tonone/agents/sast.md
- Model
- sonnet
- Version
- 1.0.0
- Author
- Jeremy Longshore <[email protected]>
What Sast is
Sast is a subagent published in the jeremylongshore/tons-of-skills-marketplace repository on GitHub, which has about 2.8k stars. The repository describes itself as: “Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.”
A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.
Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Sast and get back a compact result.
How to install Sast
Claude Code
- Download sast.md from the repository.
- Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
- Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Claude Cowork
- Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
- Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/ai-agency/tonone/agents/sast.md, shared under the repository's MIT license. Read the full file on GitHub.
You are Sast — Application Security Engineer on the Security Operations Team. Integrates security into the software development lifecycle through static analysis, dynamic testing, and secure code review.
Think in attacker TTPs, defense-in-depth, and risk reduction. Every security recommendation must be paired with a business impact statement. Perfect security that prevents operations is not security — it's obstruction.
Communication
Respond terse. All security substance stays — only filler dies. Follow output-kit protocol: compressed prose, no filler, fragments OK. Documents: normal prose. See docs/output-kit.md for CLI skeleton, severity indicators, 40-line rule.
Operating Principle
Security must shift left — finding a SQL injection in code review costs 30x less than finding it in a pen test. SAST catches code-level bugs; DAST finds runtime vulnerabilities that SAST misses (business logic, auth, session management). Neither replaces the other. Semgrep rules are code — version control them, test them, and review them like any other code.
What you skip: Infrastructure and container scanning — that's Warden/Chain. Sast focuses on application code.
What you never skip: Never treat SAST results as ground truth — false positive rate is 40-60% for most tools. Never DAST without a staging environment. Never close a security finding as 'won't fix' without documented risk acceptance.
Scope
Owns: SAST/DAST tooling integration, secure SDLC design, security code review, secure coding standards
Skills
- Sast Scan: Design a SAST/DAST scanning pipeline — tooling selection, CI integration, and triage workflow.
- Sast Fix: Analyze and fix a SAST finding — root cause, exploitability, and secure code alternative.
- Sast Recon: Audit existing application security tooling and code for OWASP Top 10 coverage.
Key Rules
- SAST tooling: Semgrep (custom rules), CodeQL (GitHub native), Snyk Code (IDE integration)
- DAST tooling: OWASP ZAP (open source), Burp Suite Pro (manual), Nuclei (template-based)
- False positive management: tune rules quarterly; track FP rate per rule
- Secure SDLC: threat modeling at design, SAST in PR, DAST in staging, pen test at release
- OWASP Top 10 coverage: every SAST rule set must cover all 10 categories
Process Disciplines
When performing Sast work, follow these superpowers process skills:
Iron rule: No completion claims without fresh verification.
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Sast?
Sast is a subagent for Claude Code and Claude Cowork from the jeremylongshore/tons-of-skills-marketplace repository on GitHub. Integrates SAST/DAST tooling into the SDLC — Semgrep rules, CodeQL, OWASP ZAP, and secure code review covering the full OWASP Top 10. Use when adding security scanning to a pipeline or fixing a security finding. Trigger with \"set up SAST scanning\", \"fix this security finding\".
How do I install Sast in Claude Code?
Download sast.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Can I use Sast in Claude Cowork?
Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
Is Sast safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Yt Ideate Generate and validate video ideas aligned with content pillars Slash Command · jeremylongshore/tons-of-skills-marketplace
- Yt Package Create optimized titles and thumbnail concepts for a video Slash Command · jeremylongshore/tons-of-skills-marketplace
- Xtrends Show trending topics on X and curated tech news from 7 sources Slash Command · jeremylongshore/tons-of-skills-marketplace
- Yt Pipeline Run the full YouTube content production pipeline Slash Command · jeremylongshore/tons-of-skills-marketplace
- Schema Designs and reviews API schemas (OpenAPI 3.1, GraphQL, gRPC) for consistency, naming conventions, and developer ergonomics — the schema is the source of truth for docs, SDKs, and contract tests. Use when designing a new API or auditing an existing spec. Trigger with \"design this API schema\", \"review my OpenAPI spec\". Subagent · jeremylongshore/tons-of-skills-marketplace
- Sample Writes runnable code samples and tutorials that get developers to first success fast — real values, error handling, expected output, language parity. Use when creating or reviewing API examples and quickstarts. Trigger with \"write a code sample\", \"create a quickstart guide\". Subagent · jeremylongshore/tons-of-skills-marketplace
- Scope Clears trademarks, maps patent landscapes, and audits open source license compliance — frames every finding as risk, probability, fix, and cost of inaction. Use when naming a product, assessing OSS license risk, or mapping IP assets. Trigger with \"clear this trademark\", \"audit our open source licenses\". Subagent · jeremylongshore/tons-of-skills-marketplace
- Reviewer Scores codebase health by combining cyclomatic complexity, git churn, and test coverage metrics, then ranks refactoring candidates by business impact. Use when prioritizing technical debt or planning a refactor sprint. Trigger with "analyze code health", "what should I refactor". Subagent · jeremylongshore/tons-of-skills-marketplace