SAST Lite

An AST-based static analyzer for Python. Instead of fragile regex matching, it parses each file into an abstract syntax tree and inspects how dangerous APIs are actually called — so subprocess.run(cmd, shell=True) is flagged while subprocess.run(["ls"]) is not. No third-party dependencies.

When to use this skill

• "Audit / security-review this Python code."
• "Run a SAST scan on the project."
• Reviewing a PR or untrusted snippet before running it.
• A pre-merge CI gate for security regressions.

What it detects

How to run it

# Scan a directory
python skills/sast-lite/analyzer.py src/

# JSON for tooling / CI
python skills/sast-lite/analyzer.py . --json

# Only show high+ severity
python skills/sast-lite/analyzer.py . --min-severity high

Exit codes: 0 clean · 1 issues found · 2 usage/parse error — ready for CI gating.

Recommended workflow for Claude

1. Run with --json and parse the issue list.
2. For each issue, open path:line and confirm the data flow is genuinely

attacker-controllable (the analyzer is intra-procedural, so it may flag patterns that are safe in context).

1. Propose a concrete fix per finding — e.g. parameterized queries for

py.sql-injection, yaml.safe_load for py.yaml-load, list-form subprocess calls for py.subprocess-shell.

1. Summarize by severity and CWE.

Limitations

This is a lite analyzer: single-file, no cross-function taint tracking. It is designed for fast, high-signal triage — not a replacement for a full SAST suite. Treat findings as leads to verify, not automatic verdicts.