skills.rest
rocklambros
rocklambrosCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

triaging-vulnerability-findings

Rank SARIF vulnerability findings by severity and reachability for multi-scanner triage.

2|Updated May 23, 2026
Search Tags:#codeql#semgrep#sarif#suppression#reachability#epss#vulnerability-triage
One-click install
npx skills add https://github.com/rocklambros/rcs --skill triaging-vulnerability-findings
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: triaging-vulnerability-findings
Source: https://github.com/rocklambros/rcs/tree/main/skills/security/triaging-vulnerability-findings
Command: npx skills add https://github.com/rocklambros/rcs --skill triaging-vulnerability-findings

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It turns overwhelming security scanner output into a ranked, defensible triage so teams can focus on the findings that matter most and avoid wasting time on noise.

Core Features & Use Cases

  • Deduplicates the same issue across Semgrep, CodeQL, Bandit, Snyk, and Trivy so one vulnerability is counted once.
  • Classifies findings by reachability, separating production issues from test-only, vendored, generated, or dead-code paths.
  • Enriches vulnerable dependency findings with EPSS and priority scoring to surface the highest-risk items first.
  • Recommends suppressions only with explicit rationale, preserving auditability instead of silently hiding results.
  • Use it when you receive a SARIF export, need a PR-ready security comment, or must decide what to fix this week versus what can be deferred.

Quick Start

Use this skill to triage the attached SARIF files, rank the findings by severity and reachability, and draft a PR-ready comment with any suppression recommendations and rationales.

Frequently Asked Questions about triaging-vulnerability-findings

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I rank SARIF vulnerability findings to identify the highest-priority issues to fix first?▼

Rank SARIF vulnerability findings by applying rule-family normalization, reachability classification, EPSS enrichment, and severity weighting to produce a defensible triage of highest-priority issues to fix first.

What is the best way to deduplicate overlapping security findings across Semgrep, CodeQL, and Snyk?▼

Deduplicate overlapping security findings across Semgrep, CodeQL, Bandit, Snyk, and Trivy through rule-family normalization, counting a single vulnerability once across multi-scanner outputs.

How do I classify vulnerability reachability to separate production issues from test-only and vendored paths?▼

Classify vulnerability reachability by separating production issues from test-only, vendored, generated, or dead-code paths identified within your security scanner outputs.

Can I use EPSS enrichment to prioritize vulnerable dependency findings in SARIF format?▼

Use EPSS enrichment to prioritize vulnerable dependency findings by applying priority scoring that surfaces highest-risk items in SARIF outputs first.

Does this approach recommend suppressions for false-positive vulnerability findings with an explicit rationale?▼

It recommends suppressions for false-positive vulnerability findings with explicit rationale comments, preserving auditability instead of silently hiding security scanner results.

Related Skills

Explore More Software Engineering Skills→
dakshrawat298-gifdakshrawat298-gif

static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Community
Advanced
hyperlane-xyzhyperlane-xyz
188

claude-security-review

Identify security vulnerabilities in frontend Web3 code during code reviews.

Official
Basic
voidrotvoidrot

sast-configuration

Configure SAST tools like Semgrep, CodeQL, and SonarQube for CI/CD pipelines.

Community
Intermediate
SuperlendSuperlend

sarif-parsing

Parse SARIF 2.1.0 files and extract structured findings for reporting.

Official
Intermediate