Reassigning Your AI Coder to Security Detail

What it does

sast-skills is a set of markdown orchestration files—CLAUDE.md for Claude Code, AGENTS.md for the rest—that repurpose your AI assistant’s agent mode to audit code for security flaws. It maps the target’s architecture and data flows, then dispatches thirteen parallel subagent tasks to hunt for vulnerability classes like SQL injection, SSRF, and business logic bugs. Finally, it synthesizes a single severity-ranked report with proof-of-concept details and remediation guidance, all using the model you already pay for.

The interesting bit

Instead of wrapping a traditional scanner, the project treats the LLM itself as the analysis engine. Each vulnerability class follows a two-phase reconnaissance-then-verification approach, and the orchestration file manages the entire workflow automatically, skipping any phase whose output already exists so you can iterate without redundant work.

Key highlights

• Covers 13 vulnerability classes, from SQL injection and GraphQL injection to insecure file uploads and JWT implementation flaws.
• Runs fully inside Claude Code, Cursor, Opencode, or Codex with no third-party dependencies.
• Parallelizes detection across subagents before consolidating findings into a ranked final report.
• Automatically resumes partially completed scans by checking for existing output files in the sast/ folder.
• Recommends Claude Code with the Opus model, but explicitly supports other IDEs and models for cost-conscious users.

Caveats

• Any existing CLAUDE.md or AGENTS.md in your project will conflict with the toolkit’s orchestration file.
• The workflow expects the target codebase to be opened inside a dedicated sast-files workspace, which may be awkward for projects that already rely on their own agent markdown.

Verdict

Developers who already live inside an AI-assisted IDE and want a quick, zero-install security sniff-test should give this a spin. If you need deterministic, compliance-grade scanning with rigorously quantified false-positive rates, you are still better served by conventional SAST tooling.