SARIF (Static Analysis Results Interchange Format) is a standard JSON-based format used by security tools to share static analysis findings consistently.

How does this help with finding deduplication?

The skill includes strategies for fingerprinting findings based on code context and rule IDs rather than just file paths, which often change between environments.

Can I use this skill to run security scans?

No, this skill is for processing existing scan results. To run the scans themselves, you should use specific skills like CodeQL or Semgrep.

Does this work with large SARIF files?

Yes, it provides implementation patterns using ijson for streaming large files (100MB+) without consuming excessive memory.

SARIF Analysis & Parsing

Name: SARIF Analysis & Parsing
Author: trailofbits

bytrailofbits

•

937

•

Security & Testing

Parse and process Static Analysis Results Interchange Format (SARIF) files to automate security audits and vulnerability management.

The SARIF Parsing skill empowers Claude to interact with standardized security scan data, making it easier to interpret complex static analysis results. It provides robust strategies for querying findings with jq, scripting with Python libraries like pysarif, and managing large datasets. Whether you are deduplicating alerts from multiple scanners, performing baseline comparisons to find regressions, or converting results for CI/CD reporting, this skill provides the domain-specific logic needed to handle security data at scale.

Key Features

01Multi-tool security result aggregation and normalization

02Baseline comparisons to identify new or resolved vulnerabilities

03937 GitHub stars

04High-performance streaming for large SARIF datasets

05Format conversion for automated HTML and CSV security reporting

06Automated finding deduplication using stable fingerprinting

Use Cases

01Extracting specific, actionable vulnerability data for security audit workflows

02Identifying regression vulnerabilities by diffing current and baseline scans

03Integrating multi-scanner security results into CI/CD pipelines

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add trailofbits/skills sarif-parsing

For use in Claude.ai and ChatGPT

Download Skill