sast-scan

# Vulnetix SAST Skill ## Use when - Pre-commit / pre-merge: scan changed source files for SAST findings. - Targeted rule check: "did we just write an XXE pattern?" via `--rule-id VNX-XXE-001`. - CI gate: exit non-zero if SAST finds critical-severity issues. - Audit a specific weakness class with `--paths <dir> --rule-id VNX-CWE-89-*`. - Augment Vulnetix's rules with the repo's own Semgrep policy. ## Don't use for - Dependency vulnerability scanning — use `/vulnetix:sca-scan`. - Secret detection — use `/vulnetix:secret-scan`. - Container/IaC scanning — use `/vulnetix:container-scan` / `/vulnetix:iac-scan`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Static analysis on source code. Capability-aware: optionally augmented with the user's own Semgrep rules. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Note `binaries.semgrep`, `repo.semgrep_config`. ## Step 2: Decide scope If `--paths` given → scan those paths. Else scan files changed since `git merge-base origin/main HEAD` (or whole repo if not a git repo). ## Step 3: Run scan ```bash vulnetix sas...