Use AI to Get Smarter, Not Lazier

Описание и применение

Использование AI для быстрой triage статических анализов может привести к когнитивному долгу, но комбинированный подход с объяснением повышает понимание и защищаемость решений.

Задача

Using AI for rapid triage of static analysis findings can leave developers with cognitive debt because they cannot explain or defend the decisions made.

Результат

The balanced shortcut keeps speed while producing explainable artifacts that reduce cognitive debt and enable engineers to defend triage decisions.

Рабочий процесс

• 1. Run Semgrep and collect findings
• 2. Use Claude Code "just triage it" prompt for quick verdicts
• 3. Identify ambiguous findings (e.g., two SQL injection cases)
• 4. Install appsec-skills plugin
• 5. Run /appsec-skills:code-walkthrough to generate sequence diagram and CodeTour
• 6. Review context, trace data flow, and security controls
• 7. Re‑evaluate findings with AI understanding
• 8. Document decisions and evidence in files

Доказательства

I ran Semgrep (the free p/default ruleset) and got a handful of findings, all marked as blocking:

Источник

The shortest path: open Claude Code, paste the Semgrep output, and ask: semgrep scan returned the below results, please triage the findings and let me know which are true and which are false positive, and suggest severity and fixes

Источник

I packaged each step as a Claude Code skill in the appsec-skills plugin, so you can repeat it:

Источник

The code-walkthrough skill produces two things for each flow: a sequence diagram and a CodeTour file

Источник