TESTING AND RELIABILITY / Trail of Bits
SARIF Parsing
Extracts and summarizes SARIF findings with reusable jq examples and a Python helper.
“Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.”
01 / THE REASONING
Why this made the selection.
- Explains run structure and severity inheritance instead of treating every absent result.level as the same severity.
- Includes extraction, filtering and summary helpers with checked-in fixtures and tests.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- Full SKILL.md
- resources/sarif_helpers.py
- resources/test_sarif_helpers.py
- jq reference and sample SARIF fixtures
- LICENSE
- plugins/static-analysis/skills/sarif-parsing/resources/sarif_helpers.py
Our findings
- The helper falls back from result.level to the rule default and then warning; its narrower severity and deduplication scope is disclosed.
- The helper resolves result severity via ruleIndex/ruleId and rule defaults, while fallback fingerprints include normalized path, line and message. First available producer fingerprints take precedence.
- The description says the skill does not run scans and points scan work at the Semgrep or CodeQL skills.
Not established by this review
- No end-to-end agent session, effectiveness benchmark or target-project security assessment was run.
- No upstream installer, helper script or generated workload was executed.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add trailofbits/skills/plugins/static-analysis/skills/sarif-parsing --skill sarif-parsingRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills add https://github.com/trailofbits/skills/tree/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing --skill sarif-parsing- Inspect the selected skill version and its supporting files before installation.
- Run the command in your terminal; choose your AI tools and project or global scope in the installer.
- Keep the complete skill directory and its licence. Install any task-specific tools separately and test on a small authorized example.
Before you start
- Node.js and npm for the Skills CLI
- An Agent Skills compatible coding assistant
- Python 3 for the optional helper; jq for the jq recipes
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing/SKILL.md
Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, access
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE
Supports: license, access.cost
https://github.com/vercel-labs/skills#readme
Supports: install, compatibility
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing/resources/sarif_helpers.py
Supports: review, limitations, access, install