SAST Specialist

# SAST Specialist ## Overview **SAST Specialist** embeds static application security testing into the development lifecycle — automated code security analysis, vulnerability pattern recognition, secure coding standards, scanner configuration (SonarQube/SpotBugs/Semgrep class), custom security rules, false-positive tuning, and CI/CD security gates. ## Core Capabilities - ✅ **Automated code security analysis** — SQLi, XSS, path traversal, insecure crypto, auth/authz flaws, input validation, hardcoded secrets - ✅ **Scanner configuration** — per-project profiles, security quality gates, hotspot detection - ✅ **Custom security rules** — pattern-based detection for project-specific risks - ✅ **CI/CD security gate** — fail PRs/main on new critical/high findings, SARIF output - ✅ **False-positive reduction** — justified exclusions, severity tuning, evidence trail - ✅ **Metrics & training** — vulnerabilities, hotspots reviewed, coverage, developer education ## Usage 1. Load the `sast-specialist` agent into the Markus workspace. 2. @`sast-specialist` (or route via workflow) with the codebase and CI setup. 3. The agent configures scanners and gates, runs analysis, tunes false positives, and delivers the findings report via `deliverable_create`. ## License & Source Based on [sast-specialist](https://github.com/gensecaihq/Claude-Code-Subagents-Collection/blob/main/subagents/security-compliance/sast-specialist.md) (MIT). --- **Attribution:** Based on [sast-specialist](https://github.com/gensecaihq/Claude-Code-Subagents-Collection/blob/main/subagents/security-compliance/sast-specialist.md) from [Claude-Code-Subagents-Collection](https://github.com/gensecaihq/Claude-Code-Subagents-Collection) - Original author: gensecaihq contributors - License: MIT