skills.rest
zeljkoobrenovic
zeljkoobrenovicCOMMUNITY
Explore all skills by this author →
Website𝕏@zeljko_obrenGitHub

sokrates-scan-core

Defines the shared findings format, evidence rules, and validate/render/merge/diff scripts for Sokrates AI scanner skills.

3|1|Updated Aug 26, 2026
Search Tags:#code analysis#json schema#scanner#evidence verification#html report#findings validation#sokrates
One-click install
npx skills add https://github.com/zeljkoobrenovic/sokrates-skills --skill sokrates-scan-core-zeljkoobrenovic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sokrates-scan-core
Source: https://github.com/zeljkoobrenovic/sokrates-skills/tree/main/skills/scanners/sokrates-scan-core
Command: npx skills add https://github.com/zeljkoobrenovic/sokrates-skills --skill sokrates-scan-core-zeljkoobrenovic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? AI-driven code analysis skills produce inconsistent, unverifiable output unless they share one contract. This Skill standardizes how every Sokrates scanner writes findings JSON with file/line evidence, mechanically validates that each cited snippet actually exists in the source, and renders all scanner results into one self-contained interactive HTML explorer. ## Core Features & Use Cases - Common findings contract: A JSON schema (schema/findings.schema.json) defining grouped findings with stable ids, severity/confidence levels, verbatim evidence citations, and links back to Sokrates metrics and components. - Deterministic tooling: Scripts to validate evidence against the real source tree, render the AI Insights Explorer (index.html) from all scanner JSON files, merge scanners into a combined report, and diff two runs of the same scanner for new/resolved/persisting findings. - Use Case: After running a tech-stack scan on a project with a _sokrates analysis, validate the findings file so every quoted line is verified, then regenerate the explorer so the team can browse severity-filtered, searchable findings in a browser. ## Quick Start Load the sokrates-scan-core skill, then run any scanner on this project, validate its findings JSON with validate_findings.py, and render the AI Insights Explorer into _sokrates/reports/ai-insights/index.html.

Frequently Asked Questions about sokrates-scan-core

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate AI scanner findings against the actual source code?▼

Run validate_findings.py on the findings JSON file; it mechanically checks that every evidence snippet occurs at the cited file and line range. On failure, re-read the file to fix line numbers, downgrade the finding to confidence 'possible', or drop it, then re-run until it reports OK.

How do I render Sokrates scanner findings as an HTML report?▼

Run render_findings.py on the _sokrates/reports/ai-insights/ directory. It embeds every scanner's findings JSON into a self-contained index.html explorer with severity filters, full-text search, and evidence citations, and must be re-run after any findings file changes.

What evidence format do Sokrates scanner findings require?▼

Each finding needs 1-3 representative citations with a file path relative to target.src_root, start and end lines, and a verbatim snippet of at most 5 lines. Findings without evidence must be marked confidence 'possible' unless grounded purely in Sokrates metrics via sokrates_refs.

Can I compare two runs of the same scanner to see what changed?▼

Yes, diff_findings.py compares two findings files using their stable ids and reports new, resolved, and persisting findings plus severity or confidence changes. It exits with code 1 when anything changed, so it works as a CI gate.

Why does findings validation fail even when the code exists?▼

Multi-line snippets must be verbatim and contiguous, including comment prefixes and everything between the cited lines, which is easy to get wrong. Prefer single-line snippets or two separate single-line evidence entries instead of one fragile multi-line one.

Related Skills

Explore More Software Engineering Skills→
Darsh20009Darsh20009

security_scan

Run dependency, SAST, and HoundDog scans in parallel and report prioritized findings.

Community
Advanced
alicangnllalicangnll

Collaborative Analysis

Merge binary analysis snapshots into unified team reports.

Community
Intermediate
anthropicsanthropics
35.8k

claude-security

Scan codebases, diffs, and commits for vulnerabilities and generate verified patch files.

Official
Advanced
AlexanderMattTurnerAlexanderMattTurner
64

vuln-research

Find, reproduce, and report security vulnerabilities against a stated threat model.

Official
Advanced