Classify security findings from Semgrep, CodeQL, and SARIF outputs.
npx skills add https://github.com/jpoley/flowspec --skill security-triage-skill
Please help me install this Agent Skill. Skill: Security Triage Skill Source: https://github.com/jpoley/flowspec/tree/main/.claude/skills/security-triage Command: npx skills add https://github.com/jpoley/flowspec --skill security-triage-skill
This Skill automates the triage of security findings by classifying results, scoring risk, and generating actionable explanations to accelerate remediation.
Use the security triage skill to triage a findings.json file and generate docs/security/triage-results.json.
High-intent search queries and answers about installing and using this skill.
Triage security findings by running this Skill on scanner outputs to automatically classify each finding as TRUE_POSITIVE, FALSE_POSITIVE, or NEEDS_INVESTIGATION, assign risk scores, and generate actionable explanations clustered by CWE or file for remediation planning.
Yes. This Skill reads outputs from Semgrep, CodeQL, SARIF, UFFormat, or custom findings files, applies deterministic classification and risk scoring across all results, and clusters them by CWE or file to help you prioritize remediation work systematically.
The Skill generates a structured JSON triage report written to docs/security/triage-results.json, containing classified findings with risk scores, confidence values, explanations, and clustered groupings ready for downstream tooling and remediation workflows.
Risk scoring evaluates each classified finding deterministically to assign a quantified risk level, enabling you to focus remediation on high-risk TRUE_POSITIVE issues first and deprioritize FALSE_POSITIVE or lower-confidence results.
The Skill accepts UFFormat and SARIF scanner outputs, as well as user-provided findings files, making it compatible with Semgrep, CodeQL, and other security scanners that export structured vulnerability data.
No dependencies are required. The Skill runs with a deterministic workflow on your input findings and outputs results directly to docs/security/triage-results.json, streamlining the triage process without additional toolchain setup.
zekiriabdParse SARIF 2.1.0 files to extract, normalize, filter, and compare static analysis findings.
shogo-labsAutomate support ticket triage and generate a dashboard blueprint.
itallstartedwithaideaCombine CodeQL data-flow queries and Semgrep rules to detect vulnerabilities.
thisisqubikaAnalyze code repositories for vulnerabilities using SAST and AI triage.
