Use AI to Get Smarter, Not Lazier

说明与用途

使用 AI 快速 triage 静态分析结果可能导致认知债务；结合 AI 生成可追溯的文档的平衡方法可降低债务并提升可辩护性。

问题

Using AI for rapid triage of static analysis findings can leave developers with cognitive debt because they cannot explain or defend the decisions made.

结果

The balanced shortcut keeps speed while producing explainable artifacts that reduce cognitive debt and enable engineers to defend triage decisions.

工作流

• 1. Run Semgrep and collect findings
• 2. Use Claude Code "just triage it" prompt for quick verdicts
• 3. Identify ambiguous findings (e.g., two SQL injection cases)
• 4. Install appsec-skills plugin
• 5. Run /appsec-skills:code-walkthrough to generate sequence diagram and CodeTour
• 6. Review context, trace data flow, and security controls
• 7. Re‑evaluate findings with AI understanding
• 8. Document decisions and evidence in files

证据

I ran Semgrep (the free p/default ruleset) and got a handful of findings, all marked as blocking:

来源

The shortest path: open Claude Code, paste the Semgrep output, and ask: semgrep scan returned the below results, please triage the findings and let me know which are true and which are false positive, and suggest severity and fixes

来源

I packaged each step as a Claude Code skill in the appsec-skills plugin, so you can repeat it:

来源

The code-walkthrough skill produces two things for each flow: a sequence diagram and a CodeTour file

来源