mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-19 04:59:28 +00:00
36 lines
1.3 KiB
Markdown
36 lines
1.3 KiB
Markdown
---
|
|
name: openultrasast-scan
|
|
description: OpenUltraSAST scan, index, quick, standard, deep, SARIF, and report workflows. Use when running or planning `ousast scan`, repository indexing, or evidence-gated SAST analysis from opencode.
|
|
---
|
|
|
|
# OpenUltraSAST Scan
|
|
|
|
Use this skill to steer OpenUltraSAST scan workflows from opencode.
|
|
|
|
## Workflow
|
|
|
|
1. Confirm the target is a local repository path.
|
|
2. Run commands through uv, never by activating a virtualenv manually.
|
|
3. Start with quick mode unless the task explicitly requires standard or deep analysis.
|
|
4. Treat quick findings as `static_corroboration`, not verified vulnerabilities.
|
|
5. Preserve run artifacts under `.openultrasast/runs/<scan-id>/`.
|
|
6. Report `scan_id`, `run_dir`, finding count, and the strongest available evidence level.
|
|
|
|
## Commands
|
|
|
|
```bash
|
|
uv run ousast scan <repo> --mode quick
|
|
uv run ousast index <repo>
|
|
uv run pytest
|
|
```
|
|
|
|
## Evidence Rules
|
|
|
|
- `suspicion` means a model or weak signal raised a hypothesis.
|
|
- `static_corroboration` means deterministic code evidence exists.
|
|
- `crash_reproduced` requires an artifact-backed reproducer.
|
|
- `root_cause_explained` requires independent verifier reasoning.
|
|
- `patch_validated` requires rerunning relevant checks after the patch.
|
|
|
|
Do not describe a finding as verified unless its evidence level meets the configured report threshold.
|