SARIF Analysis & Reporting
From the author
Processing and analyzing Static Analysis Results Interchange Format (SARIF) files for aggregating security findings across multiple scanning tools.
Install
npx skills add PramodDutta/qaskills --skill 'SARIF Analysis & Reporting' -a claude-code
Installs to .claude/skills/SARIF-Analysis---Reporting/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 85
Security100
Provenance69
Maintenance100
Licence100
Adoption40
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- sarif-parsingtrailofbits/skillsParses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.DevOps★ 7.8K
- SAST Pipeline Scanneragentskillexchange/skillsRuns static application security testing using Semgrep rules and CodeQL queries against pull request diffs. Supports SARIF output format and integrates with GitHub Advanced Security for findings management.Security★ 58
- static-application-security-testingseb1n/awesome-ai-agent-skillsAnalyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or provides relevant inputs for this workflow.Security★ 229
- semgreptrailofbits/skillsRuns a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.Security★ 7.8K
- issue-import-from-scanapache/magpieTriage a security scanner's multi-finding output (via a scan-format adapter; ASVS is the reference), bucket each finding, and apply only the operator's confirmed decisions. Publishes the report as a gist and can open a report-back PR.Security★ 126
- codeql26zl/cybersec-toolkitScans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experimental suites) and "important only" (high-precision security findings) scan modes. Also handles creating data extension models and processing CodeQL SARIF output.Security★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in