| name | openultrasast-scan |
| description | OpenUltraSAST scan, index, quick, standard, deep, SARIF, and report workflows. Use when running or planning `ousast scan`, repository indexing, or evidence-gated SAST analysis from opencode. |
OpenUltraSAST Scan
Use this skill to steer OpenUltraSAST scan workflows from opencode.
Workflow
- Confirm the target is a local repository path.
- Run commands through uv, never by activating a virtualenv manually.
- Start with quick mode unless the task explicitly requires standard or deep analysis.
- Treat quick findings as
static_corroboration, not verified vulnerabilities.
- Preserve run artifacts under
.openultrasast/runs/<scan-id>/.
- Report
scan_id, run_dir, finding count, and the strongest available evidence level.
Commands
uv run ousast scan <repo> --mode quick
uv run ousast index <repo>
uv run pytest
Evidence Rules
suspicion means a model or weak signal raised a hypothesis.static_corroboration means deterministic code evidence exists.crash_reproduced requires an artifact-backed reproducer.root_cause_explained requires independent verifier reasoning.patch_validated requires rerunning relevant checks after the patch.
Do not describe a finding as verified unless its evidence level meets the configured report threshold.
