--- title: "SARIF Parsing: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-sarif-parsing/ description: "Extracts and summarizes SARIF findings with reusable jq examples and a Python helper." --- # SARIF Parsing: review, setup & limitations · Undominated.ai > Extracts and summarizes SARIF findings with reusable jq examples and a Python helper. [← Explore all skills](/skills/) TESTING AND RELIABILITY / Trail of Bits # SARIF Parsing Extracts and summarizes SARIF findings with reusable jq examples and a Python helper. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing/SKILL.md) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher Trail of Bits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE) Revision 82fe82262526 [Read what was—and wasn’t—checked ↓](#review) “Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.” [Trail of Bits · upstream description ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Explains run structure and severity inheritance instead of treating every absent result.level as the same severity. - Includes extraction, filtering and summary helpers with checked-in fixtures and tests. ### A good fit for - Inspecting a single scanner export before CI triage - Producing a reviewable list of rule, location and severity fields - Compare scanner exports while preserving effective severity and repository-relative identities ### Weigh up before choosing - The helper is not a complete SARIF validator: invocation-level ruleConfigurationOverrides and extension rule components are not resolved. - Its fingerprint deduplication can conflate findings from different producers. Keep exports scoped to one tool and normalize paths before cross-run comparison. - A clean parser result cannot establish that the original scanner completed successfully or covered the intended code. - Line shifts and changed messages can alter fallback fingerprints; a diff labeled fixed may reflect identity changes rather than a repaired defect. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - Full SKILL.md - resources/sarif_helpers.py - resources/test_sarif_helpers.py - jq reference and sample SARIF fixtures - LICENSE - plugins/static-analysis/skills/sarif-parsing/resources/sarif_helpers.py ### Our findings - The helper falls back from result.level to the rule default and then warning; its narrower severity and deduplication scope is disclosed. - The helper resolves result severity via ruleIndex/ruleId and rule defaults, while fallback fingerprints include normalized path, line and message. First available producer fingerprints take precedence. - The description says the skill does not run scans and points scan work at the Semgrep or CodeQL skills. ### Not established by this review - No end-to-end agent session, effectiveness benchmark or target-project security assessment was run. - No upstream installer, helper script or generated workload was executed. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/vercel-labs/skills/blob/13e4063a1cf913f5606d57d42ab83a86f5001e04/README.md) DOCUMENTED COMMAND npx skills add trailofbits/skills/plugins/static-analysis/skills/sarif-parsing --skill sarif-parsing Copy command ↗ Run in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above. Optional: install the reviewed revision Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose. npx skills add https://github.com/trailofbits/skills/tree/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing --skill sarif-parsing Copy reviewed-revision command ↗ - Inspect the selected skill version and its supporting files before installation. - Run the command in your terminal; choose your AI tools and project or global scope in the installer. - Keep the complete skill directory and its licence. Install any task-specific tools separately and test on a small authorized example. ### Before you start - Node.js and npm for the Skills CLI - An Agent Skills compatible coding assistant - Python 3 for the optional helper; jq for the jq recipes ### Compatibility Agent Skills compatible clients ### Agent instructions and host-provided tools - Read local SARIF files, which can contain source snippets and sensitive paths - Write extracted reports and run the reviewed local helper or jq - Read scanner JSON, write filtered/merged SARIF or tabular output; these may contain source paths and snippets. ### Cost model CC BY-SA licensed instructions and helpers; agent usage and any separately chosen scanning services are additional. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Definition at the reviewed revision ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing/SKILL.md Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, access - [Licence at the reviewed revision ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE) Checked 2026-10-07 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE Supports: license, access.cost - [Skills CLI directory URLs and named-skill selection ↗](https://github.com/vercel-labs/skills#readme) Checked 2026-10-07 https://github.com/vercel-labs/skills#readme Supports: install, compatibility - [plugins/static-analysis/skills/sarif-parsing/resources/sarif_helpers.py ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing/resources/sarif_helpers.py) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/sarif-parsing/resources/sarif_helpers.py Supports: review, limitations, access, install KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Bug Receipt ↗ Creates an evidence-bearing defect or incident handoff that distinguishes verified, partial and blocked outcomes.](/skills/github-bug-receipt/)[### Diagnosing Bugs ↗ A debugging procedure that establishes a reproducible symptom, tests competing explanations and preserves a regression check.](/skills/mattpocock-diagnosing-bugs/)[### k6 ↗ Writes a k6 script from a matching example, then validates it by running it rather than by reading it.](/skills/grafana-k6/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)