sec-static-code-analysis

Name: sec-static-code-analysis
Availability: InStock
Author: fernansuoza

Convert raw scanner output into triaged security findings with SARIF.

Updated Mar 22, 2026

Search Tags:#security #sast #static-analysis #codeql #semgrep #code-scanning #sarif

Ready to run

npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-static-code-analysis

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sec-static-code-analysis
Source: https://github.com/FernanSuoza/AIDD-project-bootstrap/tree/main/templates/skills/sec-static-code-analysis
Command: npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-static-code-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Perform stack-aware static code analysis and security-focused source scanning to turn raw scanner output into prioritized, actionable findings and remediation work that can be tracked and verified.

Core Features & Use Cases

Stack-aware scanner selection: Detect languages and frameworks, then choose complementary tools (CodeQL, Semgrep, Bandit, ESLint) based on OWASP criteria.
Structured output & triage: Normalize findings (SARIF preferred), triage into confirmed issues, hotspots, and false positives, and produce suppression records and remediation stories.
CI and release integration: Recommend CI gating, SARIF uploads, and release gates so scanning becomes part of PR and release workflows.
Use Case: Run on a pull request to generate a triaged static analysis report, create remediation stories for high findings, and produce suppression records for false positives.

Quick Start

Run the sec-static-code-analysis skill on the repository or pull request to produce a triaged static analysis report.

Frequently Asked Questions about sec-static-code-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I convert raw SAST scanner output into triaged security findings?▼

To convert raw SAST output, static code analysis normalizes scanner results into SARIF format, then triages them into confirmed issues, hotspots, and false positives while generating suppression records and remediation stories.

Can I use CodeQL and Semgrep together for multi-language static code analysis?▼

Yes, static code analysis performs stack-aware scanner selection to detect languages and frameworks, then chooses complementary tools like CodeQL, Semgrep, Bandit, and ESLint based on OWASP criteria.

How do I integrate SAST scanning into CI pipelines and pull request workflows?▼

Static code analysis integrates with CI pipelines by recommending CI gating, SARIF uploads, and release gates, making code scanning a standard part of PR and release readiness workflows.

What is SARIF and why is it used for code scanning results?▼

SARIF is a structured output format preferred for static code analysis because it standardizes scanner findings, enabling consistent triage, CI gating, and seamless integrations across multi-language projects.

Does static code analysis work for both pull requests and full-repository scans?▼

Yes, static code analysis is applicable to pull requests, changed files, and full-repository scans across multi-language projects during both implementation and release readiness phases.

How do I handle false positives from static analysis tools like Bandit and ESLint?▼

Static code analysis triages scanner output to identify false positives and generates suppression records, allowing you to exclude specific findings while tracking confirmed issues for remediation.