sast-review

Triage SAST findings to rank true vulnerabilities and suggest remediation.

6|Updated May 30, 2026

Search Tags:#code review #vulnerability assessment #SAST #security remediation #security triage

Ready to run

npx skills add https://github.com/jassics/awesome-claude-security --skill sast-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sast-review
Source: https://github.com/jassics/awesome-claude-security/tree/main/plugins/sast-sca/skills/sast-review
Command: npx skills add https://github.com/jassics/awesome-claude-security --skill sast-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

SAST findings often contain false positives and require thorough triage to identify genuine security issues.

Core Features & Use Cases

Triage SAST Results: Evaluate findings to distinguish true positives from false positives.
Confirm Impact: Determine vulnerability class, reachability, and exploitability.
Score & Rank: Prioritize issues based on severity and reachability.
Remediate: Provide code-level fixes and secure patterns to prevent recurrence.
Use Case: For a software engineer reviewing code for security flaws, this Skill helps in identifying critical issues and implementing remediation steps.

Quick Start

Run the sast-review skill on the codebase and analyze the output findings table.

Frequently Asked Questions about sast-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I triage SAST findings to identify true security vulnerabilities?▼

To triage SAST findings, evaluate the static application security testing results to distinguish true vulnerabilities from false positives, determine exploitability, and score issues by severity. Manual intervention is required for thorough analysis and confirmation.

What is the best way to confirm and rank static application security testing results?▼

Confirming SAST results involves determining the vulnerability class, reachability, and exploitability of findings. You then score and rank these confirmed issues based on their severity and reachability to prioritize remediation efforts effectively.

How do I remediate security vulnerabilities found during code review?▼

Remediate security vulnerabilities by applying suggested code-level fixes and secure coding patterns. This approach addresses the confirmed static application security testing findings and prevents the recurrence of the identified issues in the source code.

Why do static application security testing tools report false positives?▼

SAST tools report false positives because static analysis lacks full runtime context, making it difficult to verify execution paths. Triage is necessary to manually evaluate these findings, exclude false positives, and confirm genuine security issues.

Do I need manual intervention to analyze vulnerability assessment findings?▼

Yes, manual intervention is required to analyze and confirm vulnerability assessment findings. Automated static application security testing provides the initial findings, but human review is essential to accurately triage results and validate true positives.