suppressed-skill

You can suppress false positives in bash security scans by placing suppression blocks in a designated ignore file. The scanner parses these blocks at runtime and filters out the specified findings to reduce alert fatigue.

A suppression block in a security scanner ignore file is a defined entry that silences known safe findings. It prevents alert fatigue by hiding trustworthy scripts that would otherwise trigger noisy false positives during evaluation.

To configure an ignore file, place properly formatted suppression blocks inside it. When you run the scanner, it parses the ignore file and hides the matching findings from the output, allowing you to focus on critical issues.

The suppression mechanism currently applies to bash findings, but it is designed to be extensible to other languages and scanners as needed. You can use it for trustworthy scripts that trigger false positives.

Security scans generate noise when trustworthy scripts trigger false positive findings. Honoring suppression blocks from a dedicated ignore file silences these known safe findings, reducing alert fatigue and helping you focus on critical issues.