Code review and static analysis (SAST)
3 tools. Compare how each tool runs, what it needs, where it sends data, what it can change and what its code can touch. Feed: /tasks/code-review-sast/feed.xml
| Tool | Runs and needsWhere the tool runs and what must be in place before it works. | Sends data toOutside parties the tool contacts, read from the code and the documentation. Other connections are not ruled out. | Can change thingsWhether the tool's functions only read, or also create, change or delete things, run commands, or send data out. | How to run itThe run advice where we have read the tool under the verdict rule, else what the code shows; below it, whether it has run in our lab. |
|---|---|---|---|---|
| Cloudflare Security Audit SkillDraft · awaiting review Agent skill that runs a multi-phase, source-first security audit of a codebase and verifies each candidate finding. Skill · cloudflare, pushed 2026-09-14 | Inside your AI client Works with: Claude Code Needs: A coding agent whose model supports tool use and parallel sub-agents; Node.js to run the findings and coverage-ledger validators; +2 more | none found in the files read | changes, runs commands | Code shows: writes outside the project · runs shell commands or eval · reads broad tokens or the environment Not run yet |
| Trail of Bits Agentic Actions AuditorDraft · awaiting review Claude Code plugin that statically audits GitHub Actions workflows which invoke AI coding agents for injection and permission flaws. Plugin · trailofbits, pushed 2026-10-15 | Inside your AI client Works with: Claude Code, Codex Needs: Claude Code with the trailofbits/skills plugin marketplace added; the root README also documents Codex; The GitHub CLI (gh) for remote analysis mode and remote cross-file fetches; +2 more | GitHub API (named repository), GitHub API (referenced repositories) | runs commands | Code shows: runs shell commands or eval · has broad pre-approvals Not run yet |
| Trail of Bits Static AnalysisDraft · awaiting review Claude Code plugin that drives CodeQL, Semgrep and SARIF parsing to find security vulnerabilities in a codebase. Plugin · trailofbits, pushed 2026-10-15 | Inside your AI client Works with: Claude Code, Codex Needs: Ships as a Claude Code plugin marketplace; Codex can load the same marketplace through its Claude marketplace compatibility; The CodeQL skill stops unless the codeql CLI is on PATH (gh-codeql extension, Homebrew cask or codeql-bundle); +6 more | Semgrep registry, Third-party Semgrep rule repositories, CodeQL pack registry, Target project's package registries, Homebrew | changes, deletes, runs commands | Code shows: writes outside the project · talks to any host · runs shell commands or eval · +3 more Not run yet |