Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →utkusen/sast-report
Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete.
Passed 18 of 22 test cases with the skill, and 10 of 22 without it.
and 7 more in the full report
9 fixed11 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
Suppose `sast/sqli-results.md` has 1 `[VULNERABLE]`, `sast/xss-results.md` has 1 `[LIKELY VULNERABLE]`, and `sast/rce-results.md` has 2 `[NEEDS MANUAL REVIEW]`. What is the confirmed findings count in the executive summary table of `sast/final-report.md`?
| Checked | Without skill | With skill |
|---|---|---|
| The confirmed findings total in the executive summary is 2. | Missed | Passed |
The instructions your model reads when the skill loads.
You are consolidating all completed SAST vulnerability scan results into a single prioritized security report.
Prerequisites: At least one sast/*-results.md file must exist. Run the vulnerability detection skills first if they don't.
Only include findings with these classifications from each result file:
[VULNERABLE][LIKELY VULNERABLE]Exclude [NOT VULNERABLE] and [NEEDS MANUAL REVIEW] findings from the main report body (count them only in the summary).
Assign each finding a severity tier — Critical, High, Medium, or Low — using the table below as your baseline. Adjust up or down based on context (e.g., an IDOR that exposes financial records is High, not Medium).
| Vulnerability Class | Default Severity |
|---|---|
| RCE via command injection, eval, or unsafe deserialization | Critical |
| SSTI (Server-Side Template Injection) | Critical |
| SQLi on authentication endpoints | Critical |
| JWT algorithm confusion (alg:none, RS256→HS256) | Critical |
| File upload leading to code execution (webshell) | Critical |
| SQLi with full data extraction capability | High–Critical |
| GraphQL injection (user-controlled operation document enabling unauthorized fields or gateway abuse) | High–Critical |
| XXE with file read or internal SSRF | High–Critical |
| Missing authentication on sensitive endpoints | High–Critical |
| SSRF reaching internal services or cloud metadata | High |
| Path traversal reading sensitive or config files | High |
| File upload with stored content accessible to others | High |
| IDOR on PII, financial, or health data | High |
| XSS (stored/persistent) | High |
| JWT with missing or bypassable claim validation | Medium–High |
| Missing authentication on lower-sensitivity endpoints | Medium |
test cases passed, vs 10 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.