Use AI to Get Smarter, Not Lazier

Description and use

Using AI for rapid triage of static analysis findings can create cognitive debt; a balanced shortcut that includes AI‑generated traceable artifacts reduces that debt and improves defensibility.

Problem

Using AI for rapid triage of static analysis findings can leave developers with cognitive debt because they cannot explain or defend the decisions made.

Outcome

The balanced shortcut keeps speed while producing explainable artifacts that reduce cognitive debt and enable engineers to defend triage decisions.

Workflow

• 1. Run Semgrep and collect findings
• 2. Use Claude Code "just triage it" prompt for quick verdicts
• 3. Identify ambiguous findings (e.g., two SQL injection cases)
• 4. Install appsec-skills plugin
• 5. Run /appsec-skills:code-walkthrough to generate sequence diagram and CodeTour
• 6. Review context, trace data flow, and security controls
• 7. Re‑evaluate findings with AI understanding
• 8. Document decisions and evidence in files

Evidence

I ran Semgrep (the free p/default ruleset) and got a handful of findings, all marked as blocking:

Source

The shortest path: open Claude Code, paste the Semgrep output, and ask: semgrep scan returned the below results, please triage the findings and let me know which are true and which are false positive, and suggest severity and fixes

Source

I packaged each step as a Claude Code skill in the appsec-skills plugin, so you can repeat it:

Source

The code-walkthrough skill produces two things for each flow: a sequence diagram and a CodeTour file

Source