skills.rest
FernanSuoza
FernanSuozaCOMMUNITY
Explore all skills by this author →
GitHub

sec-static-code-analysis

Convert raw scanner output into triaged security findings with SARIF.

Updated Mar 22, 2026
Search Tags:#security#sast#static-analysis#codeql#semgrep#code-scanning#sarif
One-click install
npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-static-code-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sec-static-code-analysis
Source: https://github.com/FernanSuoza/AIDD-project-bootstrap/tree/main/templates/skills/sec-static-code-analysis
Command: npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-static-code-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Perform stack-aware static code analysis and security-focused source scanning to turn raw scanner output into prioritized, actionable findings and remediation work that can be tracked and verified.

Core Features & Use Cases

  • Stack-aware scanner selection: Detect languages and frameworks, then choose complementary tools (CodeQL, Semgrep, Bandit, ESLint) based on OWASP criteria.
  • Structured output & triage: Normalize findings (SARIF preferred), triage into confirmed issues, hotspots, and false positives, and produce suppression records and remediation stories.
  • CI and release integration: Recommend CI gating, SARIF uploads, and release gates so scanning becomes part of PR and release workflows.
  • Use Case: Run on a pull request to generate a triaged static analysis report, create remediation stories for high findings, and produce suppression records for false positives.

Quick Start

Run the sec-static-code-analysis skill on the repository or pull request to produce a triaged static analysis report.

Frequently Asked Questions about sec-static-code-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I convert raw SAST scanner output into triaged security findings?▼

To convert raw SAST output, static code analysis normalizes scanner results into SARIF format, then triages them into confirmed issues, hotspots, and false positives while generating suppression records and remediation stories.

Can I use CodeQL and Semgrep together for multi-language static code analysis?▼

Yes, static code analysis performs stack-aware scanner selection to detect languages and frameworks, then chooses complementary tools like CodeQL, Semgrep, Bandit, and ESLint based on OWASP criteria.

How do I integrate SAST scanning into CI pipelines and pull request workflows?▼

Static code analysis integrates with CI pipelines by recommending CI gating, SARIF uploads, and release gates, making code scanning a standard part of PR and release readiness workflows.

What is SARIF and why is it used for code scanning results?▼

SARIF is a structured output format preferred for static code analysis because it standardizes scanner findings, enabling consistent triage, CI gating, and seamless integrations across multi-language projects.

Does static code analysis work for both pull requests and full-repository scans?▼

Yes, static code analysis is applicable to pull requests, changed files, and full-repository scans across multi-language projects during both implementation and release readiness phases.

How do I handle false positives from static analysis tools like Bandit and ESLint?▼

Static code analysis triages scanner output to identify false positives and generates suppression records, allowing you to exclude specific findings while tracking confirmed issues for remediation.

Related Skills

Explore More Software Engineering Skills→
Pabloprogramador23Pabloprogramador23

reversa-scout

Map legacy project folders, languages, frameworks, dependencies, and entry points.

Community
Intermediate
parhummparhumm
25

sec-audit-remediate

Generate fixes and regression tests from detect-dev SARIF security findings.

Community
Advanced
froggugugugufroggugugugu

security-scan

Execute SCA, SAST, DAST, and secret detection scans to report vulnerabilities.

Community
Advanced
FrekiManagarmFrekiManagarm

source-command-sparc-security-review

Perform static and dynamic code audits to flag security vulnerabilities.

Community
Advanced