<Devsly/>
NotebookLM Watermark Remover
Remove the NotebookLM watermark from PDF slide exports — free, unlimited, and 100% in your browser.
View
NotebookLM Video Watermark Remover
Remove the NotebookLM watermark from every frame of your MP4 and auto-trim the end card — free and unlimited.
View
Gemini Watermark Remover
Remove the Gemini (Veo) sparkle watermark from every frame of your AI-generated MP4 — free and unlimited.
View
MCP https://devsly.io/mcp MCP Tools Best Skills API Docs
Devsly

Keyboard Shortcuts

Navigation

Quick Search
⌘ / Ctrl + K
Toggle Dark Mode
⌘ / Ctrl + D
Close Dialogs
Esc

Tool Actions

Execute / Process
⌘ / Ctrl + Enter
Clear Input
⌘ / Ctrl + Shift + C
Copy Output
⌘ / Ctrl + Shift + X

Editor

Select All
⌘ / Ctrl + A
Undo
⌘ / Ctrl + Z
Redo
⌘ / Ctrl + Shift + Z

Updated 6mo ago

by utkusen

sast-skills

Collection of agent skills to find vulnerabilities inside your web/mobile apps.

Works with
  • Claude
View on GitHub (opens in a new tab)

1.3k GitHub stars (1,339)

+20 in 20 days

Stars gained per day · daily snapshots since Sep 26
Stars gained per day, Sep 26 to Oct 16: +20 in total; the busiest day was Oct 9 with +3 stars.Sep 27: 0 starsSep 28: 0 starsSep 29: 0 starsSep 30: +2 starsOct 1: 0 starsOct 2: +1 starsOct 3: +1 starsOct 4: 0 starsOct 5: 0 starsOct 6: +2 starsOct 7: +1 starsOct 8: 0 starsOct 9: +3 starsOct 10: +1 starsOct 11: +1 starsOct 12: +1 starsOct 13: +2 starsOct 14: +2 starsOct 15: +2 starsOct 16: +1 stars
Stars gained between daily snapshots
PeriodNew stars
Sep 270
Sep 280
Sep 290
Sep 30+2
Oct 10
Oct 2+1
Oct 3+1
Oct 40
Oct 50
Oct 6+2
Oct 7+1
Oct 80
Oct 9+3
Oct 10+1
Oct 11+1
Oct 12+1
Oct 13+2
Oct 14+2
Oct 15+2
Oct 16+1
  • 16 skills (16 skills found in its SKILL.md files)
  • 66 forks (66 forks)
  • 6mo ago last update (Last updated 6mo ago)

Install

Skills CLI

npx skills add utkusen/sast-skills

Asks which skills and agents to install. Just one: npx skills add utkusen/sast-skills --skill sast-analysis — add -g for every project.

Claude Code

git clone https://github.com/utkusen/sast-skillscp -r "sast-skills/sast-files/.agents/skills/sast-analysis" ~/.claude/skills/

Copies the sast-analysis skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.

Plugin

/plugin marketplace add utkusen/sast-skills

Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.

Skills can run code on your machine — read the SKILL.md first.

What it does

In the author's own words, from each skill's SKILL.md — showing the first 16 of 32 files.

  • sast-analysis

    Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill. Use when asked to analyze a codebase for security or when sast/architecture.md does not yet exist.

    sast-files/.agents/skills/sast-analysis/SKILL.md on GitHub (opens in a new tab)

  • sast-businesslogic

    Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results). Covers price manipulation, workflow bypass, limit violations, race conditions, reward abuse, etc. Requires sast/architecture.md (run sast-ana…

    sast-files/.agents/skills/sast-businesslogic/SKILL.md on GitHub (opens in a new tab)

  • sast-fileupload

    Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/fileupload-results.md. Use when asked to find file upload,…

    sast-files/.agents/skills/sast-fileupload/SKILL.md on GitHub (opens in a new tab)

  • sast-graphql

    Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input to those sites in parallel subagents, up to 3 candidate sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/graphql-re…

    sast-files/.agents/skills/sast-graphql/SKILL.md on GitHub (opens in a new tab)

  • sast-hardcodedsecrets

    Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates. Uses a three-phase approach: recon (find secret candidates), batched verify (confirm real secrets in public code paths, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture…

    sast-files/.agents/skills/sast-hardcodedsecrets/SKILL.md on GitHub (opens in a new tab)

  • sast-idor

    Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3 candidates each), and merge (consolidate batch results). Checks endpoints for missing ownership or authorization checks on user-supplied identifiers. Requires sast/architecture.md (run sast-analysis first).…

    sast-files/.agents/skills/sast-idor/SKILL.md on GitHub (opens in a new tab)

  • sast-jwt

    Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation. Requires…

    sast-files/.agents/skills/sast-jwt/SKILL.md on GitHub (opens in a new tab)

  • sast-missingauth

    Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the role/permission system), batched verify (check auth/authz in parallel subagents, 3 endpoints each), and merge (consolidate batch results). Covers unauthenticated access and vertical privilege escalation (e.g., regular user accessing admin-o…

    sast-files/.agents/skills/sast-missingauth/SKILL.md on GitHub (opens in a new tab)

  • sast-pathtraversal

    Detect path traversal vulnerabilities in a codebase using a three-phase approach: recon (find file-loading sinks with dynamic paths), batched verify (trace user input and mitigations in parallel subagents, 3 sinks each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/pathtraversal-results.md. Use when asked to find path tra…

    sast-files/.agents/skills/sast-pathtraversal/SKILL.md on GitHub (opens in a new tab)

  • sast-rce

    Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel subagents, 3 sinks each), and merge (consolidate batch results). Covers OS command injection, eval-like sinks, and unsafe deserialization. Requires sast/architecture.md (run sast-analysis first). Outputs findin…

    sast-files/.agents/skills/sast-rce/SKILL.md on GitHub (opens in a new tab)

  • sast-report

    Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete. Use when asked to generate a final report, consolidate findings, or summarize security results.

    sast-files/.agents/skills/sast-report/SKILL.md on GitHub (opens in a new tab)

  • sast-sqli

    Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3 sites each), and merge (consolidate batch results). Covers string concat, f-strings, unsafe ORM methods, and dynamic identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findin…

    sast-files/.agents/skills/sast-sqli/SKILL.md on GitHub (opens in a new tab)

  • sast-ssrf

    Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssrf-results.md. Use when asked to find SSRF or server-…

    sast-files/.agents/skills/sast-ssrf/SKILL.md on GitHub (opens in a new tab)

  • sast-ssti

    Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssti-results.md. U…

    sast-files/.agents/skills/sast-ssti/SKILL.md on GitHub (opens in a new tab)

  • sast-xss

    Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3 sink sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xss-results.md. Use when asked to find XSS or cross-site scrip…

    sast-files/.agents/skills/sast-xss/SKILL.md on GitHub (opens in a new tab)

  • sast-xxe

    Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to each site in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xxe-results.md. Use when asked to f…

    sast-files/.agents/skills/sast-xxe/SKILL.md on GitHub (opens in a new tab)

Review before you install

A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.