sarif-parsing — Claude Code skill: what it does, how to install
Processes existing SARIF reports from CodeQL, Semgrep, and other scanners. Use it to filter findings, remove duplicates, or prepare results for CI/CD.
npx skills add trailofbits/skills --skill sarif-parsing -a claude-codeWhat sarif-parsing does
This skill works with SARIF output already produced by CodeQL, Semgrep, or other static analysis scanners. It can filter findings, deduplicate alerts, extract vulnerability details, convert report data, and prepare it for CI/CD use.
It follows the SARIF 2.1.0 structure, including analysis runs, rules, results, file locations, and finding fingerprints. Severity can come from a result or its matched rule. This matters for CodeQL: relying on result.level alone can miss errors whose level is stored in the rule configuration.
For one-off inspection, the skill covers jq queries. Python scripts can use pysarif. You need an existing SARIF file because this skill processes scan output rather than running scans.
What it helps with
- read scan findings from a SARIF file
- combine results from several scanners
- remove duplicate security alerts
- filter findings by resolved severity
- extract rule IDs, file paths, and line numbers
Example prompts for the agent
- Parse `results.sarif` and list findings resolved as `error`.
- Aggregate these SARIF reports and deduplicate matching findings by fingerprint.
- Extract rule IDs, messages, file paths, and lines from `results.sarif`.
How to install sarif-parsing
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill sarif-parsing -a claude-code2Manually: put the files in place
~/.claude/skills/sarif-parsing/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/sarif-parsing/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill sarif-parsing -a codex2Manually: put the files in place
.agents/skills/sarif-parsing/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill sarif-parsing -a cursor2Manually: put the files in place
.cursor/skills/sarif-parsing/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills sarif-parsing2Manually: put the files in place
.github/skills/sarif-parsing/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill sarif-parsing -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/static-analysis/skills/sarif-parsingManually: put the files in place
.devin/skills/sarif-parsing/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill sarif-parsing -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set35
The whole set →Similar
Questions about sarif-parsing
How do I install sarif-parsing in Claude Code?
In Claude Code, run npx skills add trailofbits/skills --skill sarif-parsing -a claude-code, then run npx skills add trailofbits/skills --skill sarif-parsing -a claude-code again.
What does sarif-parsing do?
It processes existing SARIF reports by filtering and grouping findings, removing duplicates, and converting data for CI/CD. It does not run CodeQL, Semgrep, or other scanners.
Why does CodeQL need severity resolution from rules?
A CodeQL result can omit result.level while its rule stores the severity in defaultConfiguration.level. The skill resolves the level from the rule when needed.
