skills.rest
curtismu7
curtismu7COMMUNITY
Explore all skills by this author →
GitHub

sarif-parsing

Parse, filter, deduplicate, and aggregate SARIF static analysis results from security scanners.

1|Updated Jun 25, 2026
Search Tags:#static analysis#security scanning#deduplication#jq#codeql#semgrep#sarif
One-click install
npx skills add https://github.com/curtismu7/AI-DEMO2 --skill sarif-parsing-curtismu7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sarif-parsing
Source: https://github.com/curtismu7/AI-DEMO2/tree/main/security/sarif-parsing
Command: npx skills add https://github.com/curtismu7/AI-DEMO2 --skill sarif-parsing-curtismu7

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Static analysis tools like CodeQL and Semgrep produce large SARIF files that are hard to read, deduplicate, and compare across runs. This Skill provides proven patterns and ready-to-use utilities for extracting actionable findings from SARIF output without writing parsing logic from scratch. ## Core Features & Use Cases - Query and Filter Findings: Use 40+ ready-made jq queries or Python helpers to filter results by severity, rule ID, file path, or fingerprint. - Aggregate and Deduplicate: Merge SARIF files from multiple scanners and remove duplicate findings using stable, environment-independent fingerprints. - CI/CD Integration: Diff baseline versus current scans to detect regressions, fail builds on new high-severity issues, and convert SARIF to CSV or HTML reports. - Use Case: After a pipeline runs CodeQL and Semgrep, use this Skill to merge both SARIF outputs, deduplicate overlapping alerts, and fail the build only if new error-level findings appear. ## Quick Start Ask the assistant to parse a SARIF file such as results.sarif and summarize the findings grouped by severity and rule.

Frequently Asked Questions about sarif-parsing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I parse a SARIF file with jq?▼

Use jq to query the runs array, for example jq '[.runs[].results[]] | length' counts all findings and jq '.runs[].results[] | select(.level == "error")' extracts only errors. The Skill includes over 40 ready-made queries for filtering, grouping, and formatting SARIF data.

How do I deduplicate findings across multiple SARIF files?▼

Deduplicate using the partialFingerprints or fingerprints fields on each result, falling back to a computed hash of rule ID, filename, line, and message when fingerprints are missing. Merge the runs arrays from each file first, then drop results whose fingerprint was already seen.

What Python libraries can read SARIF files?▼

pysarif provides a typed object model for loading and saving SARIF, while sarif-tools adds reporting, diffing, and CSV or HTML conversion. For simple cases, the standard json module works since SARIF is plain JSON.

Why do SARIF fingerprints not match between runs?▼

Fingerprints mismatch when file paths differ between environments, the tool changes its fingerprinting algorithm, or code reformatting shifts line numbers. Compute a stable fingerprint from rule ID, filename only, and normalized code snippet content instead of absolute paths.

How do I handle very large SARIF files in Python?▼

Stream results with the ijson library instead of loading the whole file into memory. Iterating over runs.item.results.item yields one result at a time, which keeps memory usage flat for files over 100MB.

Can this Skill run CodeQL or Semgrep scans?▼

No, it only processes existing SARIF output from scanners that have already run. Use dedicated CodeQL or Semgrep skills to execute scans and generate the SARIF files this Skill then parses.

Related Skills

Explore More Software Engineering Skills→
zekiriabdzekiriabd
140

sarif-parsing

Parse SARIF 2.1.0 files to extract, normalize, filter, and compare static analysis findings.

Community
Advanced
xalgordxalgord
954

integrating-sast-into-github-actions-pipeline

Configure CodeQL and Semgrep scanning in GitHub Actions pipelines with SARIF uploads and merge-blocking quality gates.

Community
Intermediate
adamatdevopsadamatdevops
1

sarif-parsing

Parse and normalize OASIS SARIF scan results into filterable security findings.

Community
Intermediate
dakshrawat298-gifdakshrawat298-gif

static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Community
Advanced