static-analysis-reviewer

What problem does it solve?

This Skill helps you make sense of noisy static-analysis results by separating real security defects from false alarms, duplicates, and consciously accepted risk.

Core Features & Use Cases

• Findings triage: Confirms scanner hits against the actual source code instead of trusting rule names alone.
• Prioritization: Ranks true positives by reachability, exploitability, asset sensitivity, tenant impact, and business impact.
• Suppression governance: Requires a written rationale for every false positive or accepted-risk decision so the audit trail stays defensible.
• Use case: A security gate is red after CodeQL or SARIF scans, and you need a concise, prioritized remediation list with evidence.

Quick Start

Triage the attached SARIF or CodeQL output for our first-party code and return deduplicated findings with dispositions, ranking, and written suppression rationales.