sarif-parsing
An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, automation, developer-tools, sarif.
What it does
Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill sarif-parsingOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/static-analysis/skills/sarif-parsing ~/.claude/skills/sarif-parsingSafety box score
Grade B, low risk: 21 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill only parses and transforms SARIF files; it does not run static analysis or touch credentials. The main risks are local command execution through `jq`, global tool installation during setup, and writing transformed SARIF back to disk or other chosen paths.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 1 (low) | The helper tests execute the local `jq` binary with `subprocess.run([...])`; this is bounded command execution, not arbitrary shelling out. |
| Network access | 1 (low) | The docs point users to external services and package registries, including `sarifweb.azurewebsites.net`, `brew install jq`, `apt install jq`, and `npm install -g ajv-cli`, so setup depends on network access. |
| Filesystem reach | 1 (low) | `resources/sarif_helpers.py` writes files with `with open(path, "w") as f:` and the docs show emitting `modified.sarif`, so the skill can overwrite caller-chosen paths. |
| Secrets & credentials | 0 (none) | The skill only reads SARIF files and helper metadata; there is no code or instruction to access tokens, keychains, `.env` files, or browser sessions. |
| Privilege & persistence | 2 (moderate) | Setup instructions include system-wide installs like `brew install jq`, `apt install jq`, and `npm install -g ajv-cli`, which modify global package state and may require elevated permissions. |
| Instruction hijack surface | 0 (none) | There are no prompt-injection patterns such as hidden instructions, fetched remote prompts, or directives to ignore user/agent rules. |
| Irreversible actions | 0 (none) | The skill parses, filters, and converts SARIF; it does not send messages, deploy, publish, pay, or otherwise act autonomously on external systems. |
| Transparency | 0 (none) | All shipped content is readable source or markdown; there are no binaries, minified blobs, or decoded-at-runtime payloads. |
Before installing
- Read `resources/test_sarif_helpers.py` and decide whether local `jq` execution is acceptable in your environment.
- If you avoid global installs, use a throwaway environment before following the `brew`/`npm -g` instructions.
- Check `resources/sarif_helpers.py` if you plan to call `save_sarif()` on anything outside the workspace.
Rated 2026-10-20 by an automated review of 6 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/static-analysis/skills/sarif-parsing/SKILL.md
- Branch
- main
- Collection
- static-analysis
- Updated
- 2026-09-19
Related skills
- github-triage — Triages a repository's open GitHub issues and pull requests via the gh CLI.
- slicing-code-context — Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent.
- principle-build-the-lever — Apply to any non-trivial work, not just bulk work: edits, migrations, analyses, checks.
- audit-augmentation — Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files.
- c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
- code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.