static-analysis

Consolidate and triage CodeQL, Semgrep, and ESLint findings into a prioritized report.

15|5|Updated May 17, 2026

Search Tags:#security #eslint #static-analysis #triage #codeql #semgrep #sarif

Ready to run

npx skills add https://github.com/cropsgg/skills --skill static-analysis-cropsgg

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: static-analysis
Source: https://github.com/cropsgg/skills/tree/main/skills/engineering/static-analysis
Command: npx skills add https://github.com/cropsgg/skills --skill static-analysis-cropsgg

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Static analysis without triage is noise. The deliverable is a triaged set of findings prioritized by severity and confidence, reducing noise and speeding remediation across codebases.

Core Features & Use Cases

Language-aware tool selection: CodeQL for compiled languages, Semgrep for interpreted languages, and ESLint security rules for JavaScript/TypeScript.
SARIF-based triage: parse tool outputs, group findings by rule, and annotate findings with severity and verification steps.
Manual verification: read and validate findings before reporting and CI gating.
CI readiness: integrate triaged results into pipelines for consistent security and quality checks.
Use Case: onboarding new repositories, security audits, and regression checks across languages.

Quick Start

Run a triaged static analysis across your codebase using the recommended tool configuration.

Frequently Asked Questions about static-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I triage static analysis findings from CodeQL, Semgrep, and ESLint?▼

To triage static analysis findings, you consolidate SARIF outputs from CodeQL, Semgrep, and ESLint, group them by rule, and annotate severity to produce a prioritized findings report. This reduces noise and speeds remediation across codebases.

When do I need SARIF parsing for security audits?▼

You need SARIF parsing for security audits when consolidating results from multiple static analysis tools. SARIF provides a standardized format to group findings by rule and annotate severity, enabling a structured triage workflow across diverse codebases.

Does static analysis triage support both compiled and interpreted languages?▼

Static analysis triage supports both compiled and interpreted languages through language-aware tool selection. It uses CodeQL for compiled languages, Semgrep for interpreted languages, and ESLint security rules for JavaScript and TypeScript.

What is the best way to reduce noise from CodeQL and Semgrep results in CI pipelines?▼

The best way to reduce noise from CodeQL and Semgrep results is to apply a structured triage workflow that consolidates SARIF outputs, applies manual verification, and prioritizes findings by severity and confidence before CI gating.

Why should I manually verify static analysis findings before reporting?▼

You should manually verify static analysis findings before reporting to ensure confidence in the identified vulnerabilities. Reading and validating findings minimizes false positives, ensuring that CI gating blocks on actionable security issues rather than noise.