Local scanner-output parsing, normalization, deduplication, merging, summarization, and static-analysis triage.
Package: plugins/plugin-scanner-normalize
NPM name: @security-workbench/plugin-scanner-normalize
Quality: beta
Execution: local-only
Network: none
Persistence: none
External binaries: none
Implemented skills: 12
Owned workflows: 1
plugin-scanner-normalize owns the scanner-output domain bundle. It parses supported scanner formats, converts native outputs into common observations, deduplicates and merges normalized results, and owns the SARIF static-analysis triage workflow.
Boundary:
no scanner execution
no source checkout or source-file reads
no network enrichment
no vulnerability-feed lookup
no true-positive or exploitability verdicts
no external publishing
| Skill | Input | Output summary |
|---|---|---|
parse_trufflehog_ndjson |
TruffleHog NDJSON | detectors, sources, verification counts, and redacted secret metadata |
parse_sarif |
SARIF JSON | runs, tools, rules, results, locations, fingerprints, suppressions, fixes, and taxa |
parse_semgrep_json |
Semgrep JSON | findings, paths, severities, metadata, skipped paths, and errors |
parse_checkov_json |
Checkov JSON | failed/passed/skipped checks, resources, paths, severities, and parsing errors |
parse_grype_json |
Grype JSON | vulnerability matches, packages, source/distro metadata, and matcher details |
normalize_scanner_results |
parsed Semgrep, Checkov, or Grype output | common scanner-result observations and source references |
dedupe_scanner_results |
normalized scanner output | unique results, duplicate groups, and stable source references |
scanner_summary |
normalized, deduplicated, or merged output | compact count-based scanner summary |
merge_scanner_results |
normalized or deduplicated collections | merged result collection and scanner/source inventories |
review_static_analysis_results |
parsed SARIF output | evidence-backed local static-analysis triage signals |
score_static_analysis_attention |
static-analysis review output | deterministic review-attention score and contributions |
generate_static_analysis_triage_summary |
static-analysis score output | draft finding, Markdown summary, and display model |
static_analysis_triage
parse_sarif
→ review_static_analysis_results
→ score_static_analysis_attention
→ generate_static_analysis_triage_summary
The workflow preserves the existing skill names, step IDs, output contracts, evidence references, score model, and display behavior.
@security-workbench/core-parsers shared native-JSON parser helpers
@security-workbench/core-output shared Markdown escaping
@security-workbench/schemas runtime contracts and evidence/finding types
The plugin depends directly on shared core packages only. It does not depend on another domain plugin.
security-workbench skills run parse_semgrep_json \
--input-file "$PWD/fixtures/scanners/semgrep-results.json" \
--format pretty
security-workbench skills run parse_semgrep_json \
--input-file "$PWD/fixtures/scanners/semgrep-results.json" \
> /tmp/semgrep.parsed.json
security-workbench skills run normalize_scanner_results \
--input-file /tmp/semgrep.parsed.json \
--format pretty
security-workbench workflows run static_analysis_triage \
--input-file "$PWD/fixtures/sarif/codeql-results.sarif" \
--format prettyvalid and malformed native scanner outputs
strict input-shape validation
secret-value redaction for TruffleHog observations
normalization across supported scanner families
deterministic deduplication and merge behavior
SARIF evidence and signal preservation
explainable score contributions
Markdown escaping and structured display output
profile and enable/disable registration behavior
fixture-backed smoke coverage
Does not execute scanners.
Does not inspect source code beyond scanner-provided locations and metadata.
Does not verify true-positive or false-positive status.
Does not determine exploitability.
Does not perform CVE, EPSS, KEV, package-registry, or repository enrichment.
Does not send or persist findings.