Automate triage of semgrep findings to identify true positives.
npx skills add https://github.com/chrismcmacken/bounty-hunter --skill review-semgrep
Please help me install this Agent Skill. Skill: review-semgrep Source: https://github.com/chrismcmacken/bounty-hunter/tree/main/.claude/skills/review-semgrep Command: npx skills add https://github.com/chrismcmacken/bounty-hunter --skill review-semgrep
This Skill helps security teams quickly identify real vulnerabilities in semgrep results by automating triage and reducing false positives, saving time during threat hunting.
Use the skill to generate a concise summary of semgrep findings for an organization by running the extraction scripts and reviewing the resulting findings in findings/ and reports/.
High-intent search queries and answers about installing and using this skill.
Automate semgrep findings triage by running existing extraction scripts in the ./scripts/ directory to produce summaries and verify counts, distinguishing true vulnerabilities from false positives across multiple repositories.
Review semgrep findings across many repositories by centralizing context from findings/ and reports/ directories, enabling efficient decision making and allowing security engineers to focus on high-severity issues requiring remediation.
Yes, this semgrep triage approach scales to large projects like jitsi and tronprotocol, correlating results from multiple findings directories to help security teams manage hundreds of findings efficiently.
No custom scripts are needed to triage semgrep false positives; the process requires using the existing extraction scripts in ./scripts/ to generate concise summaries and verify finding counts.
Centralized review correlates semgrep results by aggregating findings and reports directories, enabling security analysts to correlate artifacts and make efficient remediation decisions without manually inspecting each repository.
Automated triage helps with semgrep security reviews by reducing false positives and saving time during threat hunting, allowing security teams to quickly identify real vulnerabilities across multiple repositories.
hardw00tOrchestrate Semgrep, CodeQL, and Bandit scans across codebases.
cropsggIdentifies all occurrences of a known vulnerability pattern across a codebase.
thisisqubikaAnalyze code repositories for vulnerabilities using SAST and AI triage.
roderikMap variant vulnerabilities across a codebase using pattern-based analysis.
