---
title: "SAST Configuration"
type: skill
id: "wshobson-agents/threat-modeling/sast-configuration"
category: "Security"
publisher: "Seth Hobson"
license: "MIT"
source: "https://github.com/wshobson/agents/tree/7e2fb55"
canonical: "https://labs.pho.chat/en/skills/wshobson-agents/threat-modeling/sast-configuration"
open_in_pho: "https://pho.chat/customize?item=wshobson-agents%2Fthreat-modeling%2Fsast-configuration&utm_source=labs&utm_medium=skill-page&utm_campaign=skills-library"
---

# SAST Configuration

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Source: Seth Hobson (MIT), copied at a pinned commit. Free to use. Part of the Phở Skills library (https://labs.pho.chat/en/skills).
Skill set: Threat modeling (https://labs.pho.chat/en/skills/wshobson-agents/threat-modeling.md).

## What it covers
- Overview
- Core Capabilities
  - 1. Semgrep Configuration
  - 2. SonarQube Setup
  - 3. CodeQL Analysis
- Quick Start
  - Initial Assessment
  - Basic Setup
- Integration Patterns
  - CI/CD Pipeline Integration
  - Pre-commit Hook
- Best Practices
- Common Use Cases
  - New Project Setup
  - Custom Rule Development
  - Compliance Scanning
- Troubleshooting
  - High False Positive Rate
  - Performance Issues
  - Integration Failures

## Other skills in this set
- [Attack Tree Construction](https://labs.pho.chat/en/skills/wshobson-agents/threat-modeling/attack-tree-construction.md): Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
- [Security Requirement Extraction](https://labs.pho.chat/en/skills/wshobson-agents/threat-modeling/security-requirement-extraction.md): Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
- [STRIDE Analysis Patterns](https://labs.pho.chat/en/skills/wshobson-agents/threat-modeling/stride-analysis-patterns.md): Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
- [Threat Mitigation Mapping](https://labs.pho.chat/en/skills/wshobson-agents/threat-modeling/threat-mitigation-mapping.md): Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

## Use it
- In Phở: open https://pho.chat/customize?item=wshobson-agents%2Fthreat-modeling%2Fsast-configuration&utm_source=labs&utm_medium=skill-page&utm_campaign=skills-library and press Try, or add it so Phở loads it whenever a request matches. Phở works with your own API key (OpenAI, Anthropic, Google and others).
- Full instructions (original SKILL.md, unchanged): https://labs.pho.chat/skills/raw/wshobson-agents/threat-modeling/skills/sast-configuration/SKILL.md
- Original files: https://github.com/wshobson/agents/tree/7e2fb55 (MIT).
- Full machine-readable index: https://labs.pho.chat/skills.json