skills.rest
fianulabs
fianulabsOFFICIAL
Explore all skills by this author →
Website𝕏@fianulabsGitHub

working-with-findings-and-violations

Reads Fianu violations, findings, and vulnerability detail for assets and evidence notes.

1|Updated Jun 11, 2026
Search Tags:#vulnerabilities#cve#findings#violations#security evidence#fianu#compliance api
One-click install
npx skills add https://github.com/fianulabs/fianu-skills --skill working-with-findings-and-violations-fianulabs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: working-with-findings-and-violations
Source: https://github.com/fianulabs/fianu-skills/tree/main/skills/working-with-findings-and-violations
Command: npx skills add https://github.com/fianulabs/fianu-skills --skill working-with-findings-and-violations-fianulabs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security and compliance data on the Fianu platform lives in two independent pipelines — violations recorded by Rego rules at evaluation time and normalized findings extracted from plugin schemas at read time — and confusing them leads to wrong or empty results. This Skill teaches how to query each correctly, target the right asset series, and interpret the Finding schema without inventing data. ## Core Features & Use Cases - Violation reads: Query GET /evidence/assets/:asset/violations with the required seriesId parameter, understanding that only controls with non-empty violation rows are returned and gates are excluded. - Normalized findings: Call GET /notes/:uuid/findings to get typed findings with CVE/CWE identifiers, CVSS scores, severity, category, and remediation guidance, including the matchKey correlation to violations. - Raw note inspection: Use GET /notes/:uuid?format=raw to read display.violations.rows directly when a plugin lacks findings annotations (e.g., SonarQube). - Use Case: A user asks for all vulnerabilities on a container image. The Skill directs you to call /findings first, and if it returns empty because the plugin has no findings annotations, fall back to the raw note instead of reporting no data. ## Quick Start List all violations and normalized findings for asset my-service on the correct series, including CVE identifiers and CVSS scores.

Frequently Asked Questions about working-with-findings-and-violations

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I list violations for a Fianu asset?▼

Call GET /evidence/assets/:asset/violations with a seriesId query parameter, which is required and returns 400 without it. The endpoint returns only controls whose attestations have non-empty violation rows; gate attestations are excluded.

What is the difference between findings and violations in Fianu?▼

Violations are untyped objects a Rego rule records at evaluation time, while findings are normalized, typed items extracted from plugin schema annotations at read time. They are independent pipelines joined only by an opt-in matchKey correlation, so neither is a subset of the other.

Why does the findings endpoint return an empty array?▼

Findings are opt-in per plugin: a plugin whose schema has no x-findings-* annotations yields an empty findings array regardless of how much evidence exists. SonarQube is one such plugin, so read its data off the raw note instead.

Why do I get empty violations for an asset that has vulnerabilities?▼

An empty array means no violations on the series you queried, not that the asset is clean. Attestations land on exactly one series, so confirm the correct seriesId before reporting the asset as clean.

Is severity a fixed enum in the Fianu Finding schema?▼

No, severity is lowercased but otherwise passed through verbatim from the plugin schema's value map, so unmapped values survive as-is. Common values like critical, high, medium, low, and info appear, but you should not branch on an assumed closed set.

How do I read violation rows from a Fianu note directly?▼

Call GET /notes/:uuid?format=raw and read $.display.violations.rows. The format=raw parameter is required because the default pretty format strips display down to just tag and color.

Related Skills

Explore More Software Engineering Skills→
stbenjamstbenjam
2

find-incomplete-series

Identifies unfinished Calibre series and outputs the next unread title per series.

Community
Advanced
BruceTyndallBruceTyndall

proof-pack

Aggregate QA audit JSON files into a summary report with a pass/fail gate decision.

Community
Intermediate
Samuelca6399Samuelca6399

product-analytics

Design product metrics hierarchies for funnel, cohort, and feature adoption analysis.

Community
Advanced
endorlabsendorlabs
2

endor-api

Query Endor Labs API for findings, projects, packages, and metrics.

Official
Advanced