skills.rest
jassics
jassicsCOMMUNITY
Explore all skills by this author →
Website𝕏@jassicsGitHub

sast-review

Triage SAST findings to rank true vulnerabilities and suggest remediation.

6|Updated May 30, 2026
Search Tags:#code review#vulnerability assessment#SAST#security remediation#security triage
One-click install
npx skills add https://github.com/jassics/awesome-claude-security --skill sast-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-review
Source: https://github.com/jassics/awesome-claude-security/tree/main/plugins/sast-sca/skills/sast-review
Command: npx skills add https://github.com/jassics/awesome-claude-security --skill sast-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

SAST findings often contain false positives and require thorough triage to identify genuine security issues.

Core Features & Use Cases

  • Triage SAST Results: Evaluate findings to distinguish true positives from false positives.
  • Confirm Impact: Determine vulnerability class, reachability, and exploitability.
  • Score & Rank: Prioritize issues based on severity and reachability.
  • Remediate: Provide code-level fixes and secure patterns to prevent recurrence.
  • Use Case: For a software engineer reviewing code for security flaws, this Skill helps in identifying critical issues and implementing remediation steps.

Quick Start

Run the sast-review skill on the codebase and analyze the output findings table.

Frequently Asked Questions about sast-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage SAST findings to identify true security vulnerabilities?▼

To triage SAST findings, evaluate the static application security testing results to distinguish true vulnerabilities from false positives, determine exploitability, and score issues by severity. Manual intervention is required for thorough analysis and confirmation.

What is the best way to confirm and rank static application security testing results?▼

Confirming SAST results involves determining the vulnerability class, reachability, and exploitability of findings. You then score and rank these confirmed issues based on their severity and reachability to prioritize remediation efforts effectively.

How do I remediate security vulnerabilities found during code review?▼

Remediate security vulnerabilities by applying suggested code-level fixes and secure coding patterns. This approach addresses the confirmed static application security testing findings and prevents the recurrence of the identified issues in the source code.

Why do static application security testing tools report false positives?▼

SAST tools report false positives because static analysis lacks full runtime context, making it difficult to verify execution paths. Triage is necessary to manually evaluate these findings, exclude false positives, and confirm genuine security issues.

Do I need manual intervention to analyze vulnerability assessment findings?▼

Yes, manual intervention is required to analyze and confirm vulnerability assessment findings. Automated static application security testing provides the initial findings, but human review is essential to accurately triage results and validate true positives.

Related Skills

Explore More Software Engineering Skills→
brenordvbrenordv

security

Audit software systems for security vulnerabilities and regulatory compliance.

Community
Advanced
Marshall-HallenbeckMarshall-Hallenbeck
5

security-review

Audit uncommitted git changes for security vulnerabilities and remediation.

Community
Advanced
CENKSSSCENKSSS

pentest-validation

Validate SAST and DAST vulnerability exploitability through a 4-phase pipeline.

Community
Advanced
manuelbrandner85manuelbrandner85

fp-check

Validate suspected security vulnerabilities through data flow analysis and gate reviews.

Community
Advanced