mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-22 14:39:28 +00:00

Files

T

Marius CiepluchandClaude Fable 5.1 69b5e0efcc chore(skills): move the project skills from .opencode/skills to .agent/skills

Maintainer decision 2026-10-02 (no symlink). AGENTS.md, README, the two spec
docs, the kiro-spec-batch skill and the provenance ignore list are repointed;
the OpenCode plugin package.json stays under .opencode.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

2026-10-02 19:17:19 +02:00

1.3 KiB

Raw Blame History

name, description

name	description
openultrasast-scan	OpenUltraSAST scan, index, quick, standard, deep, SARIF, and report workflows. Use when running or planning `ousast scan`, repository indexing, or evidence-gated SAST analysis from opencode.

OpenUltraSAST Scan

Use this skill to steer OpenUltraSAST scan workflows from opencode.

Workflow

Confirm the target is a local repository path.
Run commands through uv, never by activating a virtualenv manually.
Start with quick mode unless the task explicitly requires standard or deep analysis.
Treat quick findings as static_corroboration, not verified vulnerabilities.
Preserve run artifacts under .openultrasast/runs/<scan-id>/.
Report scan_id, run_dir, finding count, and the strongest available evidence level.

Commands

uv run ousast scan <repo> --mode quick
uv run ousast index <repo>
uv run pytest

Evidence Rules

suspicion means a model or weak signal raised a hypothesis.
static_corroboration means deterministic code evidence exists.
crash_reproduced requires an artifact-backed reproducer.
root_cause_explained requires independent verifier reasoning.
patch_validated requires rerunning relevant checks after the patch.

Do not describe a finding as verified unless its evidence level meets the configured report threshold.

1.3 KiB Raw Blame History

OpenUltraSAST Scan

Workflow

Commands

Evidence Rules

1.3 KiB

Raw Blame History