sast-lite

Stars12

Forks5

UpdatedJune 7, 2026 at 11:03

Static security analysis for Python source via AST walking — finds command injection, insecure deserialization, eval/exec, weak crypto, SQL injection, disabled TLS verification, hardcoded secrets and more, each tagged with a CWE. Use when the user asks to "audit this code for vulnerabilities", "run a SAST scan", "security review this Python file", or before merging untrusted code.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

NovaCode37

NovaCode37/claude-security-skills

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

3 files

SKILL.md

readonly

name	sast-lite
description	Static security analysis for Python source via AST walking — finds command injection, insecure deserialization, eval/exec, weak crypto, SQL injection, disabled TLS verification, hardcoded secrets and more, each tagged with a CWE. Use when the user asks to "audit this code for vulnerabilities", "run a SAST scan", "security review this Python file", or before merging untrusted code.
license	MIT

SAST Lite

An AST-based static analyzer for Python. Instead of fragile regex matching, it parses each file into an abstract syntax tree and inspects how dangerous APIs are actually called — so subprocess.run(cmd, shell=True) is flagged while subprocess.run(["ls"]) is not. No third-party dependencies.

When to use this skill

"Audit / security-review this Python code."
"Run a SAST scan on the project."
Reviewing a PR or untrusted snippet before running it.
A pre-merge CI gate for security regressions.

What it detects

Rule	CWE	Severity
`eval()` / `exec()` on dynamic input	CWE-95	critical/high
`os.system` / `subprocess(shell=True)`	CWE-78	high
`pickle`/`marshal` deserialization	CWE-502	high
`yaml.load` without SafeLoader	CWE-20	high
SQL via f-string / concat / `.format` / `%`	CWE-89	high
`requests(verify=False)`	CWE-295	high
Hardcoded password/secret literal	CWE-798	high
Weak hash (md5/sha1)	CWE-327	medium
`tempfile.mktemp`	CWE-377	medium
`Flask(debug=True)`	CWE-489	medium
Jinja2 `autoescape=False`	CWE-79	medium
`assert` used for a security check	CWE-617	medium

How to run it

# Scan a directory
python skills/sast-lite/analyzer.py src/

# JSON for tooling / CI
python skills/sast-lite/analyzer.py . --json

# Only show high+ severity
python skills/sast-lite/analyzer.py . --min-severity high

Exit codes: 0 clean · 1 issues found · 2 usage/parse error — ready for CI gating.

Recommended workflow for Claude

Run with --json and parse the issue list.
For each issue, open path:line and confirm the data flow is genuinely attacker-controllable (the analyzer is intra-procedural, so it may flag patterns that are safe in context).
Propose a concrete fix per finding — e.g. parameterized queries for py.sql-injection, yaml.safe_load for py.yaml-load, list-form subprocess calls for py.subprocess-shell.
Summarize by severity and CWE.

Limitations

This is a lite analyzer: single-file, no cross-function taint tracking. It is designed for fast, high-signal triage — not a replacement for a full SAST suite. Treat findings as leads to verify, not automatic verdicts.

More from this repository

same repository

cors-auditor

NovaCode37/claude-security-skills

Audit a site's Cross-Origin Resource Sharing (CORS) configuration for misconfigurations — wildcard origin with credentials, reflected arbitrary Origin, the 'null' origin, overly broad allowed methods, and risky credentialed CORS. Use when the user asks to "check my CORS config", "is my API's CORS safe", "test for CORS misconfiguration", or "why can any site call my API".

2026-06-2312

dockerfile-scan

NovaCode37/claude-security-skills

Scan a Dockerfile for insecure build patterns — running as root, unpinned or :latest base images, ADD from remote URLs, piping curl/wget into a shell, hardcoded secrets in ENV/ARG, world-writable chmod 777, and sudo usage. Use when the user asks to "review my Dockerfile", "is this container image secure", "lint my Dockerfile for security", or "why does my image run as root".

2026-06-2312

dependency-check

NovaCode37/claude-security-skills

Audit project dependencies for known-vulnerable versions and risky pinning. Parses requirements.txt and package.json, matches a bundled offline advisory DB, optionally queries OSV.dev live, and warns about unpinned versions. Use when the user asks to "check dependencies for vulnerabilities", "audit my requirements.txt / package.json", "scan for vulnerable packages", or "is my dependency tree secure".

2026-06-0812

secret-scanner

NovaCode37/claude-security-skills

Scan a codebase for hardcoded secrets — API keys, tokens, private keys and passwords — using a custom regex + Shannon-entropy engine. Use when the user asks to "find secrets", "check for leaked credentials", "scan for API keys", do a pre-commit secret check, or audit a repo before making it public.

2026-06-0712

prompt-injection-tester

NovaCode37/claude-security-skills

Red-team an LLM application against prompt injection and jailbreaks using a curated, categorized payload library and canary-based detection, then produce a resilience score. Use when the user asks to "test my chatbot for prompt injection", "check if my AI app is jailbreakable", "red-team my LLM", "evaluate prompt-injection defenses", or audit a system prompt's guardrails.

2026-06-0712

jwt-inspector

NovaCode37/claude-security-skills

Decode and security-audit a JSON Web Token — flag alg=none, missing/excessive expiry, symmetric-alg confusion risk, missing claims — and attempt an offline HMAC secret crack against a wordlist to detect weak signing keys. Use when the user asks to "decode this JWT", "is this token secure?", "audit a JWT", or "check if this token uses a weak secret".

2026-06-0712

name	sast-lite
description	Static security analysis for Python source via AST walking — finds command injection, insecure deserialization, eval/exec, weak crypto, SQL injection, disabled TLS verification, hardcoded secrets and more, each tagged with a CWE. Use when the user asks to "audit this code for vulnerabilities", "run a SAST scan", "security review this Python file", or before merging untrusted code.
license	MIT

SAST Lite

When to use this skill

"Audit / security-review this Python code."
"Run a SAST scan on the project."
Reviewing a PR or untrusted snippet before running it.
A pre-merge CI gate for security regressions.

What it detects

Rule	CWE	Severity
`eval()` / `exec()` on dynamic input	CWE-95	critical/high
`os.system` / `subprocess(shell=True)`	CWE-78	high
`pickle`/`marshal` deserialization	CWE-502	high
`yaml.load` without SafeLoader	CWE-20	high
SQL via f-string / concat / `.format` / `%`	CWE-89	high
`requests(verify=False)`	CWE-295	high
Hardcoded password/secret literal	CWE-798	high
Weak hash (md5/sha1)	CWE-327	medium
`tempfile.mktemp`	CWE-377	medium
`Flask(debug=True)`	CWE-489	medium
Jinja2 `autoescape=False`	CWE-79	medium
`assert` used for a security check	CWE-617	medium

How to run it

# Scan a directory
python skills/sast-lite/analyzer.py src/

# JSON for tooling / CI
python skills/sast-lite/analyzer.py . --json

# Only show high+ severity
python skills/sast-lite/analyzer.py . --min-severity high

Exit codes: 0 clean · 1 issues found · 2 usage/parse error — ready for CI gating.

Recommended workflow for Claude

Run with --json and parse the issue list.
For each issue, open path:line and confirm the data flow is genuinely attacker-controllable (the analyzer is intra-procedural, so it may flag patterns that are safe in context).
Propose a concrete fix per finding — e.g. parameterized queries for py.sql-injection, yaml.safe_load for py.yaml-load, list-form subprocess calls for py.subprocess-shell.
Summarize by severity and CWE.