Home / Stacks / Static Analysis & AppSec
🔍

Static Analysis & AppSec

Find and triage vulnerabilities at scale — run CodeQL and Semgrep, parse and dedupe SARIF, hunt bug variants, scan for secrets, and catch insecure defaults

6 skills · Works with Claude Code, Codex, Cursor & more

⚙️ Engineering
RARE

CodeQL Security Analysis

Scan a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking. Build databases, run security-and-quality and experimental suites, and process SARIF output to surface high-precision findings.

Trail of Bits 1.9K
Scanned
security sast codeql
mkdir -p ~/.claude/skills/community-codeql-analysis && curl -fsSL https://raw.githubusercontent.com/trailofbits/skills/HEAD/plugins/static-analysis/skills/codeql/SKILL.md -o ~/.claude/skills/community-codeql-analysis/SKILL.md
⚙️ Engineering
RARE

Semgrep Static Analysis

Run lightweight static analysis on your code using Semgrep. Supports 30+ languages with customizable rules for security vulnerabilities, bug patterns, and code style enforcement.

Trail of Bits 2.8K
Scanned
security sast static-analysis
mkdir -p ~/.claude/skills/semgrep-sast && curl -fsSL https://raw.githubusercontent.com/trailofbits/skills/HEAD/plugins/semgrep-rule-creator/skills/semgrep-rule-creator/SKILL.md -o ~/.claude/skills/semgrep-sast/SKILL.md
⚙️ Engineering
RARE

SARIF Results Parser

Parse, filter, deduplicate, and convert SARIF output from CodeQL, Semgrep, and other scanners. Aggregate findings across tools and wire results into CI/CD without re-running the scans themselves.

Trail of Bits 1.5K
Scanned
security sarif static-analysis
mkdir -p ~/.claude/skills/community-sarif-parsing && curl -fsSL https://raw.githubusercontent.com/trailofbits/skills/HEAD/plugins/static-analysis/skills/sarif-parsing/SKILL.md -o ~/.claude/skills/community-sarif-parsing/SKILL.md
⚙️ Engineering
RARE

Vulnerability Variant Analysis

After finding one bug, hunt for its variants across the codebase using pattern-based analysis. Helps build CodeQL and Semgrep queries to systematically find every instance of a vulnerability class.

Trail of Bits 1.3K
Scanned
security variant-analysis codeql
mkdir -p ~/.claude/skills/community-variant-analysis && curl -fsSL https://raw.githubusercontent.com/trailofbits/skills/HEAD/plugins/variant-analysis/skills/variant-analysis/SKILL.md -o ~/.claude/skills/community-variant-analysis/SKILL.md
⚙️ Engineering
RARE

Insecure Defaults Detector

Detect fail-open insecure defaults — hardcoded secrets, weak auth, and overly permissive security settings — that let an app run insecurely in production. Audits config management and environment variable handling.

Trail of Bits 1.6K
Scanned
security configuration secrets
mkdir -p ~/.claude/skills/community-insecure-defaults && curl -fsSL https://raw.githubusercontent.com/trailofbits/skills/HEAD/plugins/insecure-defaults/skills/insecure-defaults/SKILL.md -o ~/.claude/skills/community-insecure-defaults/SKILL.md
⚙️ Engineering
RARE

TruffleHog Secrets Scanner

Scan your codebase for leaked credentials, API keys, and secrets using TruffleHog. Detects 800+ credential types with live verification against real APIs to confirm which leaks are active.

Trail of Bits 3.2K
Scanned
security secrets credentials
mkdir -p ~/.claude/skills/trufflehog-secrets && curl -fsSL https://raw.githubusercontent.com/trailofbits/skills/HEAD/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/SKILL.md -o ~/.claude/skills/trufflehog-secrets/SKILL.md

More Stacks

🤝

Agent Engineering Kit

Engineer reliable AI agents — build on the Claude Agent SDK, coordinate teams with multi-agent patterns, give them memory, and keep them safe with mechanical guardrails and evaluation
🕹️

AI Agent Frameworks

Pick the right framework and ship agents fast — type-safe Python with Pydantic AI, multi-agent orchestration with OpenAI Agents SDK, Agno, and CrewAI, TypeScript graphs with LangGraph.js, and typed workflows with Mastra
🤖

AI Builder Stack

Build AI-powered applications with RAG, multi-agent systems, prompt engineering, and MCP integrations

View all stacks →

Added to wishlist