Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    SAST Finding Triage Skill

    1

    Triage SAST security findings by deduplicating noise, validating context, and prioritizing remediation queues.

    $5.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    SAST Finding Triage Skill

    SAST Finding Triage Skill

    Example session with this skill installed

    Triage these 3 findings from our recent SonarQube SARIF export. Include asset criticality 'High' for the 'billing-service' repository and identify if any are duplicates or false positives.

    • Read your context and instructions
    • Compiled the sast finding triage

    The SARIF export for the billing-service has been processed. I have normalized 3 findings into 2 unique issue groups, identified one likely false positive due to framework-level sanitization, and prioritized the remaining critical vulnerability.

    SAST Triage Executive Summary

    • Total findings: 3
    • Unique findings/groups: 2
    • Confirmed/likely issues: 1
    • False-positive candidates: 1
    • Highest-priority area: SQL Injection in db_manager.py
    • Data limitations: Missing authentication context for session findings.

    Finding Triage Table

    Finding/GroupRuleCategorySeverityConfidenceClassificationPriorityReason
    G-001S2100SQLiCriticalHighConfirmedP0Direct user input to cursor.execute
    F-002S5144SSRFMediumLowLikely FPP3Input passed through url_validator

    Remediation Queue

    PriorityFinding/GroupRecommended ActionOwnerVerification
    P0G-001 (SQLi)Implement parameterized queries via SQLAlchemy corePlatform TeamRe-scan and manual PR review
    P3F-002 (SSRF)Document existing validator as a compensating controlSecurity TeamValidation logic audit

    Developer Handoff

    Issue: SQL Injection in billing-service/db_manager.py
    Location: Line 42, fetch_user_record function.
    Impact: Unauthorized database access and data exfiltration.
    Remediation: Replace string formatting in the query builder with prepared statements. Ensure all inputs to the query are cast to expected types before execution.
    Acceptance Criteria: The code must pass the SAST S2100 check and undergo a manual peer review of the database layer.

    Next steps

    1. Export the G-001 handoff as a Jira ticket for the Platform Team.
    2. Update the suppression list for F-002 with the provided evidence of validation.
    3. Provide the full db_manager.py source if you need specific code refactoring for G-001.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The problem

    Security scanners generate hundreds of noisy alerts, often burying critical vulnerabilities under duplicates and false positives. Developers lose hours manually verifying scanner output instead of fixing code.

    What it does

    • Normalizes heterogeneous findings from SARIF, JSON, or CSV exports into a standard schema.
    • Groups duplicates by root cause and data-flow similarity to reduce alert volume.
    • Validates source-to-sink reachability and framework protections to identify false-positive candidates.
    • Calculates remediation priority by weighing technical severity against asset criticality and exposure.
    • Generates structured developer handoff tickets with actionable remediation guidance.

    Frameworks & tools

    Works with SARIF-compliant tools, OWASP/CWE mappings, and standard SAST exports. Compatible with major framework security patterns and CI/CD pipeline metadata.

    Why this beats prompting it yourself

    Generic prompts often conflate scanner severity with actual business risk or hallucinate data flow. This skill enforces a strict evidence-based triage logic that separates technical confidence from business priority and prevents the suppression of findings without documented justification.

    Use cases

    • Cleaning up a massive backlog of legacy security debt after a new scanner rollout.
    • Pre-processing CI/CD security gate results to prevent breaking builds on known false positives.
    • Converting raw security audits into prioritized Jira tickets for engineering teams.

    Known limitations

    Requires specific evidence to confirm exploitability. Missing metadata is marked as unknown rather than inferred.

    Requires evidence-based input to confirm reachability. Cannot verify fixes without updated code or scanner results. Marking findings as safe requires explicit proof of sanitization.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 month ago

    Permissions

    No special permissions declared or detected

    Listed1 month ago

    What's inside

    Frequently Asked Questions

    This skill streamlines the vulnerability management process by automatically grouping duplicate alerts, filtering out false positives through context validation, and prioritizing the remaining risks based on your specific business environment.

    The skill is designed to work with any security tool that exports data in SARIF, JSON, or CSV formats, making it compatible with most industry-standard SAST scanners and CI/CD pipelines.

    Unlike generic prompts, this skill uses a specialized evidence-based logic that prevents 'hallucinating' data flows and ensures that findings are only suppressed when there is documented justification.

    You will receive the structured skill configuration, integration templates for popular task management tools, and documentation for mapping your scanner exports to the triage schema.

    The skill requires access to the raw scanner output and, ideally, metadata regarding the asset's criticality to accurately calculate remediation priority and reachability.

    New in Security