New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Analyze Findings

by seqra in seqra/opentaint

Triage OpenTaint findings statically. An agent skill from seqra/opentaint.

Apache-2.0Auto-check passedSecurity

Install Analyze Findings

skills CLI
$ npx skills add seqra/opentaint --skill analyze-findings -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install seqra/opentaint analyze-findings --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/analyze-findings .claude/skills/analyze-findings && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
analyze-findings
GitHub stars
162
Token cost
~1.3k tokens
SKILL.md length
684 words
Files
1
Skills in repo
16
Repo updated
First seen
Licence
Apache-2.0

At a glance

Triage OpenTaint findings statically. An agent skill from seqra/opentaint.

  • Works in 4 steps: Reconcile before judging → One result at a time — STOP checklist → Split the bundle into logical findings → …
  • Scan findings need a TP/FP verdict
  • SKILL.md covers Inputs, Workflow, Output and Tracking, plus 2 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Analyze Findings is an agent skill from seqra/opentaint. Triage OpenTaint findings statically. Use when scan findings need a TP/FP verdict

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST. The repository describes itself as: The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis… The licence is Apache-2.0.

When your agent uses it

  • Scan findings need a TP/FP verdict
  • Tasks that involve Static analysis and SAST

Example prompts

  • “/analyze-findings”

Requirements

  • Docker

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Reconcile before judging
  2. One result at a time — STOP checklist
  3. Split the bundle into logical findings
  4. Classify and record

What it can do on your machine

Read from SKILL.md and the folder at commit f945f92. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are yaml).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Analyze Findings loads about 1.3k tokens when it runs. Until then it costs about 25 tokens; SKILL.md has 684 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~25
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from seqra/opentaint at commit f945f92, republished under its Apache-2.0 licence (© seqra). 684 words, ~1,340 tokens.

Download SKILL.mdSave it as .claude/skills/analyze-findings/SKILL.md (or your agent's skills folder).
name
analyze-findings
description
Triage OpenTaint findings statically. Use when scan findings need a TP/FP verdict
license
Apache-2.0
metadata.author
opentaint
metadata.version
0.3.0

Skill: Analyze Findings

A finding file bundles all of one rule's results. Read each result's code flow, split the bundle into distinct vulnerabilities, and give each a TP/FP verdict on its own evidence

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

  • project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory
  • language (required) — target language for this project and language-specific instructions
  • findings (required) — the finding file(s) to triage, each .opentaint/tracking/findings/<name>.yaml bundling one rule's SARIF results in sarif_hashes

Workflow

1. Reconcile before judging

A finding whose notes open with a reconcile line is a rescan result under a rule whose other findings are already triaged — most often the same vulnerability with a shifted hash, not a new one. Before judging it fresh, read the rule's already-triaged finding files and compare flows (source → sink, same essential path): if one matches, move this finding's sarif_hashes into that finding, drop this file, and let the inherited verdict stand — don't re-judge a flow already triaged. Only when no triaged finding matches do you treat it as new and continue below.

2. One result at a time — STOP checklist

For each hash in the bundle, before any verdict, read its raw result from .opentaint/results/report.sarif:

  • find its SARIF result via sarif_hashes — each entry is the leading 16 chars of that result's vulnerabilitySourceSinkHash/vulnerabilityWithTraceHash fingerprint, so match it against the result's fingerprints/partialFingerprints — then read the raw codeFlows[]
  • walk every step, source → hops → sink, confirming it's the same tainted value end to end; confirm the flow against the application source (the built project's own sources under .opentaint/project/sources/) and dependency code, not the trace text alone
  • judge each result on its own trace — no verdict shared across results just because they share the rule
3. Split the bundle into logical findings

The results in the file all fired one rule, but may be several different vulnerabilities. Keep results that are the same vulnerability (same sink, same essential flow) together as one finding; move genuinely distinct ones into their own finding file with a new name and their sarif_hashes (per Tracking).

Show full SKILL.md (309 more words)Show less
4. Classify and record

Verdict each logical finding from its flow:

  • TP — the source is attacker-controlled, the sink is genuinely dangerous with that input, and nothing sanitizes it in between
  • FP — a sanitizer/validator neutralizes it, the source isn't actually attacker-controlled (config, constant, server-set), the sink is safe for this input (parameterized, escaped), or the path is infeasible. Record which one

Set verdict and append the reasoning to notes, below the analyzer report already seeded there (per Tracking).

Output

Artifacts
  • .opentaint/tracking/findings/<name>.yaml — each triaged finding with verdict set and the rationale appended to notes; a split also writes new finding file(s) (per Tracking)
Summary
  • one line per finding: name, verdict, one-clause reason

Tracking

This skill writes only each finding's verdict and the reasoning appended to notes. A split additionally creates a new finding file — a fresh docker-like name, the moved sarif_hashes, and rule_id copied from the bundle, carrying the seeded analyzer report into its notes and leaving poc pending. Never touch the poc field, or the sarif_hashes of a finding you keep.

.opentaint/tracking/findings/<name>.yaml — one finding, bundling one rule's SARIF results and carrying it through triage and PoC. A script seeds each file from the scan — its sarif_hashes, rule_id, and the analyzer report in notes. Triage sets verdict and appends its reasoning. The PoC stage sets poc and appends its outcome. Keep it clear from comments

yaml
sarif_hashes: [a1b2c3d4, e5f6a7b8]
rule_id: <language>/security/sql-injection.yaml:sql-injection
verdict: TP
notes: >
  <analyzer report for these results — seeded from the scan>
  triage: the request's order field is attacker-controlled and reaches raw query construction → TP
  poc: a crafted order value produced the expected database delay → confirmed
poc: confirmed

Constraints

  • Verdicts and notes go in the finding files only — never write .opentaint/vulnerabilities.md; the orchestrator assembles it from the verdicts
  • Judge each result on its own trace, never share one verdict across results just because they fired the same rule

Gotchas

  • Bulk verdicts are the most common triage error — many results marked under one shared rationale with the traces unread
  • A rule's bundle is not one finding — split distinct vulnerabilities apart, but keep true duplicates (same sink and flow) together as one finding with multiple sarif_hashes

© seqra, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/analyze-findings of seqra/opentaint.

Open the folder on GitHubat commit f945f92

Compare with similar skills

Analyze Findings next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Analyze Findings compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Analyze Findings this skillseqra/opentaint162—~1.3kAutomated safety check: PassApache-2.0
Semgrepvigolium/piolium1401 repos~2.4kAutomated safety check: NotesMIT
C To AstNarwhal-Lab/MagicSkills316—~1.1kAutomated safety check: PassMIT
Semgrep Security Scantrailofbits/skills7.4k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
LLM Sast ScannerSunWeb3Sec/llm-sast-scanner286—~6.2kAutomated safety check: PassNone
Sast SemgrepAgentSecOps/SecOpsAgentKit2202 repos~2.4kAutomated safety check: PassCustom licence

Similar skills

  • Semgrep

    vigolium/piolium

    Run Semgrep static analysis scan on a codebase using parallel subagents.

    140 GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check: notes

  • C To Ast

    Narwhal-Lab/MagicSkills

    Parse C source code into an Abstract Syntax Tree (AST). An agent skill from Narwhal-Lab/MagicSkills.

    316 GitHub stars~1.1k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated yesterday
    SecurityAuto-check: notes

  • LLM Sast Scanner

    SunWeb3Sec/llm-sast-scanner

    General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.

    286 GitHub stars~6.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Sast Semgrep

    AgentSecOps/SecOpsAgentKit

    Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.

    220 GitHub starsUsed in 2 repos~2.4k tokens
    SecurityAuto-check passed

  • Triage Codeql

    netdata/netdata

    Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.

    81k GitHub stars~1.8k tokensUpdated yesterday
    SecurityAuto-check: notes

More from seqra/opentaint

All 16 skills in this repo

  • Analyze External Methods

    seqra/opentaint

    Analyze an OpenTaint scan's dropped external methods and decide which of them are propagators and optionally sinks.

    162 GitHub stars~3.2k tokensUpdated yesterday
    Auto-check passed

  • Create Dataflow Approximation

    seqra/opentaint

    Model a method's taint propagation as code-based dataflow approximation and refine it against a test project until the sample passes.

    162 GitHub stars~1.9k tokensUpdated yesterday
    Auto-check passed

  • Orchestrate Stage

    seqra/opentaint

    Run one stage of the OpenTaint pipeline by coordinating leaf subagents and deterministic joins.

    162 GitHub stars~806 tokensUpdated yesterday
    Auto-check passed

  • Appsec Agent

    seqra/opentaint

    Run an end-to-end OpenTaint application-security analysis while owning the long project build and scans and delegating each other pipeline stage.

    162 GitHub stars~2.2k tokensUpdated yesterday
    Auto-check passed

  • Build Project

    seqra/opentaint

    Build a target project into an opentaint project model. An agent skill from seqra/opentaint.

    162 GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed

  • Create Pass Through Approximation

    seqra/opentaint

    Model a method's taint propagation as a passThrough approximation.

    162 GitHub stars~1.7k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about Analyze Findings

What does Analyze Findings do?

Triage OpenTaint findings statically. An agent skill from seqra/opentaint. Analyze Findings is an agent skill from seqra/opentaint. Triage OpenTaint findings statically.

When should I use Analyze Findings?

Analyze Findings fits situations like: scan findings need a TP/FP verdict; tasks that involve Static analysis and SAST.

How do I install Analyze Findings in Claude Code?

Run `npx skills add seqra/opentaint --skill analyze-findings -a claude-code`. Or copy the skill folder (skills/analyze-findings in seqra/opentaint) into .claude/skills/analyze-findings in your project. Claude Code loads it when a task matches its description.

How do I install Analyze Findings in Codex?

Run `npx skills add seqra/opentaint --skill analyze-findings -a codex`. Or copy the skill folder (skills/analyze-findings in seqra/opentaint) into .agents/skills/analyze-findings in your project. Codex loads it when a task matches its description.

Can I use Analyze Findings in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add seqra/opentaint --skill analyze-findings -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/analyze-findings, .gemini/skills/analyze-findings, .github/skills/analyze-findings and .opencode/skills/analyze-findings in your project.

What does Analyze Findings need to run?

SKILL.md names no scripts, command-line tools or credentials: Analyze Findings is instructions for the agent only. Our summary lists: Docker.

Does Analyze Findings access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Analyze Findings safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Analyze Findings use?

Analyze Findings is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Analyze Findings use?

About 1.3k tokens (SKILL.md is roughly 5.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Analyze Findings?

Skills that share tags, products or a category with Analyze Findings: Semgrep (vigolium/piolium, 140 stars), C To Ast (Narwhal-Lab/MagicSkills, 316 stars), Semgrep Security Scan (trailofbits/skills, 7.4k stars) and LLM Sast Scanner (SunWeb3Sec/llm-sast-scanner, 286 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Analyze Findings?

seqra (a GitHub organization) maintains it in seqra/opentaint, which has 162 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on October 7, 2026.

Source: seqra/opentaint on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.