Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    SAST Finding Triage Skill

    1

    Triage SAST security findings by deduplicating noise, validating context, and prioritizing remediation queues.

    $5.99

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    SAST Finding Triage Skill

    SAST Finding Triage Skill

    Example session with this skill installed

    Triage these 3 findings from our recent SonarQube SARIF export. Include asset criticality 'High' for the 'billing-service' repository and identify if any are duplicates or false positives.

    • Read your context and instructions
    • Compiled the sast finding triage
    • Generated the document

    The SARIF export for the billing-service has been processed. I have normalized 3 findings into 2 unique issue groups, identified one likely false positive due to framework-level sanitization, and prioritized the remaining critical vulnerability.

    SAST Triage Executive Summary

    • Total findings: 3
    • Unique findings/groups: 2
    • Confirmed/likely issues: 1
    • False-positive candidates: 1
    • Highest-priority area: SQL Injection in db_manager.py
    • Data limitations: Missing authentication context for session findings.

    Finding Triage Table

    Finding/GroupRuleCategorySeverityConfidenceClassificationPriorityReason
    G-001S2100SQLiCriticalHighConfirmedP0Direct user input to cursor.execute
    F-002S5144SSRFMediumLowLikely FPP3Input passed through url_validator

    Remediation Queue

    PriorityFinding/GroupRecommended ActionOwnerVerification
    P0G-001 (SQLi)Implement parameterized queries via SQLAlchemy corePlatform TeamRe-scan and manual PR review
    P3F-002 (SSRF)Document existing validator as a compensating controlSecurity TeamValidation logic audit

    Developer Handoff

    Issue: SQL Injection in billing-service/db_manager.py
    Location: Line 42, fetch_user_record function.
    Impact: Unauthorized database access and data exfiltration.
    Remediation: Replace string formatting in the query builder with prepared statements. Ensure all inputs to the query are cast to expected types before execution.
    Acceptance Criteria: The code must pass the SAST S2100 check and undergo a manual peer review of the database layer.

    Next steps

    1. Export the G-001 handoff as a Jira ticket for the Platform Team.
    2. Update the suppression list for F-002 with the provided evidence of validation.
    3. Provide the full db_manager.py source if you need specific code refactoring for G-001.

    sast-finding-triage-skill.pdf

    PDF · document

    Generated

    Example file from a real run - the skill writes it into your workspace.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Deduplicate scanner noise by grouping findings with the same root cause.Identify false positives by analyzing reachability and sanitization context.Prioritize vulnerabilities using asset criticality and technical severity.Generate actionable developer tickets with specific remediation steps.

    About this skill

    The problem

    Security scanners generate hundreds of noisy alerts, often burying critical vulnerabilities under duplicates and false positives. Developers lose hours manually verifying scanner output instead of fixing code.

    What it does

    • Normalizes heterogeneous findings from SARIF, JSON, or CSV exports into a standard schema.
    • Groups duplicates by root cause and data-flow similarity to reduce alert volume.
    • Validates source-to-sink reachability and framework protections to identify false-positive candidates.
    • Calculates remediation priority by weighing technical severity against asset criticality and exposure.
    • Generates structured developer handoff tickets with actionable remediation guidance.

    Frameworks & tools

    Works with SARIF-compliant tools, OWASP/CWE mappings, and standard SAST exports. Compatible with major framework security patterns and CI/CD pipeline metadata.

    Why this beats prompting it yourself

    Generic prompts often conflate scanner severity with actual business risk or hallucinate data flow. This skill enforces a strict evidence-based triage logic that separates technical confidence from business priority and prevents the suppression of findings without documented justification.

    Use cases

    • Cleaning up a massive backlog of legacy security debt after a new scanner rollout.
    • Pre-processing CI/CD security gate results to prevent breaking builds on known false positives.
    • Converting raw security audits into prioritized Jira tickets for engineering teams.

    Known limitations

    Requires specific evidence to confirm exploitability. Missing metadata is marked as unknown rather than inferred.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 3 days ago

    • Passed all security checks, Safe to install

    Listed3 days ago

    What's inside

    Frequently Asked Questions