Open_Ultra_SAST/.opencode/skills/openultrasast-scan/SKILL.md

name, description

name	description
openultrasast-scan	OpenUltraSAST scan, index, quick, standard, deep, SARIF, and report workflows. Use when running or planning `ousast scan`, repository indexing, or evidence-gated SAST analysis from opencode.

OpenUltraSAST Scan

Use this skill to steer OpenUltraSAST scan workflows from opencode.

Workflow

1. Confirm the target is a local repository path.
2. Run commands through uv, never by activating a virtualenv manually.
3. Start with quick mode unless the task explicitly requires standard or deep analysis.
4. Treat quick findings as static_corroboration, not verified vulnerabilities.
5. Preserve run artifacts under .openultrasast/runs/<scan-id>/.
6. Report scan_id, run_dir, finding count, and the strongest available evidence level.

Commands

uv run ousast scan <repo> --mode quick
uv run ousast index <repo>
uv run pytest

Evidence Rules

• suspicion means a model or weak signal raised a hypothesis.
• static_corroboration means deterministic code evidence exists.
• crash_reproduced requires an artifact-backed reproducer.
• root_cause_explained requires independent verifier reasoning.
• patch_validated requires rerunning relevant checks after the patch.

Do not describe a finding as verified unless its evidence level meets the configured report threshold.