skills.rest
zekiriabd
zekiriabdCOMMUNITY
Explore all skills by this author →
GitHub

sarif-parsing

Parse SARIF 2.1.0 files to extract, normalize, filter, and compare static analysis findings.

140|20|Updated Jun 20, 2026
Search Tags:#ci/cd#static analysis#deduplication#fingerprinting#sarif#code scanning#security findings
One-click install
npx skills add https://github.com/zekiriabd/SDD-Pro --skill sarif-parsing-zekiriabd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sarif-parsing
Source: https://github.com/zekiriabd/SDD-Pro/tree/main/.sdd/skills/sarif-parsing
Command: npx skills add https://github.com/zekiriabd/SDD-Pro --skill sarif-parsing-zekiriabd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the manual effort of interpreting, filtering, aggregating, and comparing SARIF results from static analysis tools, making security findings easier to review and act on.

Core Features & Use Cases

  • SARIF Analysis: Read SARIF 2.1.0 files, inspect runs, tools, rules, findings, locations, and severity levels.
  • Finding Management: Normalize paths, extract structured findings, filter results, compute fingerprints, deduplicate alerts, and compare baseline results with current scans.
  • Reporting and Integration: Aggregate multiple SARIF files, generate summaries and CSV-ready data, validate structure, and support CI/CD regression checks.
  • Use Case: Combine CodeQL and Semgrep SARIF outputs, remove duplicate alerts, identify new errors in a pull request, and group the remaining findings by file or rule.

Quick Start

Use the sarif-parsing skill to analyze the attached SARIF file, summarize findings by severity, and identify new issues compared with the provided baseline.

Frequently Asked Questions about sarif-parsing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I parse SARIF files from CodeQL and Semgrep to extract security findings?▼

To parse SARIF files, the skill reads SARIF 2.1.0 outputs from CodeQL and Semgrep, normalizes paths, and extracts structured static analysis security findings for review.

Can I deduplicate static analysis alerts across multiple SARIF scan outputs?▼

Yes, you can deduplicate static analysis alerts by computing stable fingerprints for findings across multiple SARIF files, removing duplicate alerts, and grouping remaining results by file or rule.

How do I compare baseline SARIF results with current scans for CI/CD regression checks?▼

You compare baseline SARIF results with current scans to identify new errors in a pull request, supporting CI/CD regression workflows without needing to run additional scans.

What is the best way to aggregate SARIF findings and generate CSV-ready security reports?▼

Aggregating SARIF findings involves reading multiple SARIF files, summarizing findings by severity level, and generating structured CSV-ready data for security reporting and analysis.

Does SARIF parsing require defensive handling for optional fields in static analysis outputs?▼

SARIF parsing requires defensive handling of optional fields, validating the SARIF 2.1.0 structure, and inspecting runs, tools, rules, locations, and severity levels to ensure stable reporting.

Related Skills

Explore More Software Engineering Skills→
vigoliumvigolium
965

sarif-parsing

Convert SARIF static analysis outputs into deduplicated findings for CI/CD gating.

Official
Intermediate
ayehiaaayehiaa

sarif-parsing

Parse SARIF security scan outputs into deduplicated findings and summaries.

Community
Intermediate
elizaOSelizaOS
19.0k

static-analysis

Run CodeQL and Semgrep scans and parse SARIF results.

Official
Advanced
andrescardonas7andrescardonas7

sarif-parsing

Parse SARIF 2.1.0 files and aggregate security findings from multiple tools.

Community
Intermediate