# Sast Report

Consolidate all SAST vulnerability results from the sast/ folder into a single final...

- Repository: https://github.com/utkusen/sast-skills (1357 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-23
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add utkusen/sast-skills --skill sast-report -g -a claude-code -y`
Codex: `npx skills add utkusen/sast-skills --skill sast-report -g -a codex -y`
Cursor: `npx skills add utkusen/sast-skills --skill sast-report -g -a cursor -y`
Gemini CLI: `npx skills add utkusen/sast-skills --skill sast-report -g -a gemini-cli -y`

## Description

Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete. Use when asked to generate a final report, consolidate findings, or summarize security results.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Final Security Report Generation

You are consolidating all completed SAST vulnerability scan results into a single prioritized security report.

**Prerequisites**: At least one `sast/*-results.md` file must exist. Run the vulnerability detection skills first if they don't.

---

## What to Include

Only include findings with these classifications from each result file:
- `[VULNERABLE]`
- `[LIKELY VULNERABLE]`

Exclude `[NOT VULNERABLE]` and `[NEEDS MANUAL REVIEW]` findings from the main report body (count them only in the summary).

---

## Severity Ranking

Assign each finding a severity tier, **Critical**, **High**, **Medium**, or **Low**, using the table below as your baseline. Adjust up or down based on context (e.g., an IDOR that exposes financial records is High, not Medium).

The rest: https://github.com/utkusen/sast-skills/blob/HEAD/sast-files/.agents/skills/sast-report/SKILL.md