SAST Orchestrator
When to use
This skill configures static-analysis tooling and keeps the noise low enough that findings stay actionable. It's the engine behind phase 3 of security-review and the SAST gate of /security-gate.
Activates on:
- A request like "set up Semgrep on this repo", "which CodeQL query suite should we use", "our SonarQube is full of false positives", "integrate SAST in CI".
- Existing SAST output that needs to be triaged before it goes to developers.
- PR-comment
[Description truncada. Veja o README completo no GitHub.]