review-semgrep

Name: review-semgrep
Availability: InStock
Author: chrismcmacken

Automate triage of semgrep findings to identify true positives.

Updated Dec 25, 2025

Search Tags:#automation #security #review #triage #semgrep #findings #false-positives

Ready to run

npx skills add https://github.com/chrismcmacken/bounty-hunter --skill review-semgrep

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: review-semgrep
Source: https://github.com/chrismcmacken/bounty-hunter/tree/main/.claude/skills/review-semgrep
Command: npx skills add https://github.com/chrismcmacken/bounty-hunter --skill review-semgrep

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps security teams quickly identify real vulnerabilities in semgrep results by automating triage and reducing false positives, saving time during threat hunting.

Core Features & Use Cases

Automated triage: Distinguish true positives from noise across multiple repositories and findings directories.
Centralized review: Correlate semgrep results with reports and artifacts to enable efficient decision making.
Use Case: A security engineer reviews hundreds of findings from jitsi and tronprotocol projects and focuses on high-severity issues that require remediation.

Quick Start

Use the skill to generate a concise summary of semgrep findings for an organization by running the extraction scripts and reviewing the resulting findings in findings/ and reports/.

Frequently Asked Questions about review-semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate semgrep findings triage to identify true positives?▼

Automate semgrep findings triage by running existing extraction scripts in the ./scripts/ directory to produce summaries and verify counts, distinguishing true vulnerabilities from false positives across multiple repositories.

What is the best way to review semgrep findings across many repositories?▼

Review semgrep findings across many repositories by centralizing context from findings/ and reports/ directories, enabling efficient decision making and allowing security engineers to focus on high-severity issues requiring remediation.

Can I use this semgrep triage approach for large projects like jitsi or tronprotocol?▼

Yes, this semgrep triage approach scales to large projects like jitsi and tronprotocol, correlating results from multiple findings directories to help security teams manage hundreds of findings efficiently.

Do I need to write custom scripts to triage semgrep false positives?▼

No custom scripts are needed to triage semgrep false positives; the process requires using the existing extraction scripts in ./scripts/ to generate concise summaries and verify finding counts.

How does centralized review correlate semgrep results with reports?▼

Centralized review correlates semgrep results by aggregating findings and reports directories, enabling security analysts to correlate artifacts and make efficient remediation decisions without manually inspecting each repository.

Why does automated triage help with semgrep security reviews?▼

Automated triage helps with semgrep security reviews by reducing false positives and saving time during threat hunting, allowing security teams to quickly identify real vulnerabilities across multiple repositories.