sarif-issue-reporter（萨里夫问题记者）

SARIF Issue Reporter

Analyze SARIF files and generate comprehensive security reports.

Target: $ARGUMENTS (path to SARIF file)

When to Use This Skill

• Reviewing static analysis results from security scanners
• Generating vulnerability reports with CVSS scoring
• Validating SAST findings (true vs false positives)
• Mapping vulnerabilities to compliance frameworks
• Creating remediation guidance with code examples

Core Capabilities

Workflow

Phase 1: Parse SARIF

1. Load SARIF file at $ARGUMENTS
2. Extract tool metadata from runs[].tool.driver
3. Get all results from runs[].results[]
4. Categorize by severity level

Phase 2: Verify Each Issue

1. Extract: Location, snippet, codeFlows, related locations
2. Verify: Confirm issue exists, check for false positives, assess exploitability
3. Enhance: Request additional code context if needed

Phase 3: Security Assessment

CVSS 3.1 Scoring - Calculate and justify each metric:

• Attack Vector (AV): N/A/L/P
• Attack Complexity (AC): L/H
• Privileges Required (PR): N/L/H
• User Interaction (UI): N/R
• Scope (S): U/C
• Impact (C/I/A): N/L/H each

Vector format: CVSS:3.1/AV:_/AC:_/PR:_/UI:_/S:_/C:_/I:_/A:_

Impact Analysis: Technical impact, business impact, exploitability, affected assets.

Phase 4: Standards Mapping

Map each verified issue to:

Reference: OWASP Top 10 | CWE | CAPEC

Phase 5: Report Generation

For each verified issue, generate this report structure:

## [ISSUE-XXX] {Title}

**Severity**: {Critical|High|Medium|Low} | **CVSS**: {Score} ({Vector}) | **Status**: Verified

### Summary
{2-3 sentence overview}

### Code Evidence
**Location**: `{file}:{line}`

{code snippet with context}

### Exploitation

**Attack Vector**: {Description} **PoC**: {Example exploit code or request} **Prerequisites**: {What attacker needs}

### Impact

- **C/I/A**: {Confidentiality/Integrity/Availability impacts}
- **Business**: {Consequences}

### Standards Mapping

- **OWASP**: {Category}
- **CWE**: CWE-{ID}
- **CAPEC**: CAPEC-{ID}
- **Compliance**: {PCI-DSS/GDPR/SOC2 requirements}

### Security Patterns Violated

- **{Pattern}**: Expected {X}, found {Y}

### Remediation

**Priority**: {Level}

{Fix code}

**Steps**: {Implementation guidance}

### Validation

{Test commands or verification steps}

Implementation Steps

1. Load SARIF - Parse JSON at $ARGUMENTS path
2. Extract Issues - Get runs[].results[] array
3. For Each Issue:

- Get location from physicalLocation - Read code context if snippet missing - Verify finding exists in source - Calculate CVSS with justification - Map to standards (OWASP/CWE/CAPEC) - Generate remediation code

1. Output Report - Markdown format (primary)

Quality Checklist

Before finalizing each issue:

• [ ] CVSS score calculated with justification
• [ ] Code evidence with context
• [ ] Realistic exploitation scenario
• [ ] Security pattern identified
• [ ] OWASP/CWE/CAPEC mapped
• [ ] Working remediation code

SARIF Reference: SARIF 2.1.0 Spec

Example Usage

User: Analyze results.sarif and report critical/high issues Claude:

1. Parse SARIF → 2. Filter by severity → 3. Verify each finding
2. Calculate CVSS → 5. Map to standards → 6. Generate report

Best Practices

Executive Summary Template

# Security Analysis Report
**Tool**: {name} | **Date**: {date} | **Scope**: {files scanned}

## Overview
| Metric | Count |
|--------|-------|
| Total Issues | {n} |
| Verified | {n} |
| False Positives | {n} |

## Severity Distribution
Critical (9.0-10.0): {n} | High (7.0-8.9): {n} | Medium (4.0-6.9): {n} | Low (0.1-3.9): {n}

## Top Risks
1. {Issue} - CVSS {score}
2. {Issue} - CVSS {score}
3. {Issue} - CVSS {score}

Anti-Patterns

• Reporting unverified issues
• Generic remediation advice
• Missing exploitation scenarios
• Incomplete CVSS justification
• Ignoring code context

Success Criteria

• All critical/high issues verified
• CVSS scores justified
• Working exploitation examples
• Production-ready remediation code
• Complete standards mapping

References

• SARIF Spec
• CVSS Calculator
• OWASP Cheat Sheets

Helper script available: scripts/sarif_helper.py