skills.rest
sbknana
sbknanaCOMMUNITY
Explore all skills by this author →
GitHub

sarif-parsing

Parse SARIF files to deduplicate findings and generate structured reports.

10|4|Updated Feb 5, 2026
Search Tags:#security#deduplication#parsing#ci-cd#fingerprinting#sarif
One-click install
npx skills add https://github.com/sbknana/equipa --skill sarif-parsing-sbknana
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sarif-parsing
Source: https://github.com/sbknana/equipa/tree/main/skills/security/static-analysis/skills/sarif-parsing
Command: npx skills add https://github.com/sbknana/equipa --skill sarif-parsing-sbknana

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This SARIF parsing workflow enables you to read, analyze, and normalize results from static analysis tools in SARIF format, deduplicating alerts and preparing them for CI/CD pipelines and security reviews.

Core Features & Use Cases

  • Parse SARIF files from multiple scanners and consolidate results
  • Deduplicate findings using stable fingerprints and cross-run comparison
  • Aggregate, summarize, and format findings for dashboards, reports, or CI feedback
  • Use Case: Merge results from CodeQL and Semgrep, then surface unique high-severity issues across the codebase

Quick Start

Provide a SARIF file to the skill and it will parse, deduplicate findings, and generate a structured report

Frequently Asked Questions about sarif-parsing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I parse and merge SARIF files from multiple security scanners?▼

To parse and merge SARIF files from multiple security scanners, provide the files to this workflow. It reads, analyzes, and normalizes results, consolidating findings from different tools into a single structured output for CI/CD pipelines and security reviews.

What is the best way to deduplicate static analysis alerts across CI/CD runs?▼

The best way to deduplicate static analysis alerts across CI/CD runs is by generating stable fingerprints for each finding. This workflow uses fingerprinting and cross-run comparison to identify and remove duplicate vulnerabilities across merged SARIF results.

Can I combine CodeQL and Semgrep SARIF results into a single report?▼

Yes, you can combine CodeQL and Semgrep SARIF results into a single report. This workflow parses SARIF files from multiple scanners, aggregates the findings, and formats them into a unified summary to surface unique high-severity issues.

Does this SARIF parsing workflow require any external dependencies?▼

No, this SARIF parsing workflow does not require any external dependencies or components. It includes built-in normalization and validation utilities to safely extract data and process security findings without needing additional environment setup.

How do I normalize SARIF results for post-run triage and dashboards?▼

To normalize SARIF results for post-run triage and dashboards, this workflow processes the raw scanner output and applies validation utilities. It extracts, deduplicates, and summarizes findings, preparing the formatted data for immediate feedback or reporting.

Related Skills

Explore More Software Engineering Skills→
cropsggcropsgg
15

static-analysis

Consolidate and triage CodeQL, Semgrep, and ESLint findings into a prioritized report.

Community
Advanced
EntroVyxEntroVyx
3

cross-attack-chains

Chain medium and high-severity vulnerabilities into critical-impact attack paths.

Community
Advanced
iiammaeiiammae

sarif-parsing

Parse SARIF files with filtering, deduplication, and format conversion.

Community
Intermediate
zekiriabdzekiriabd
140

sarif-parsing

Parse SARIF 2.1.0 files to extract, normalize, filter, and compare static analysis findings.

Community
Advanced