validate-sarif Skill
Validates SARIF files against the SARIF 2.1.0 schema and the AI-generated-findings profile rules shipped by Sarif.Multitool. Published by microsoft in sarif-sdk.
What is validate-sarif Skill?
Validates SARIF files against the SARIF 2.1.0 schema and the AI-generated-findings profile rules shipped by Sarif.Multitool. Published by microsoft in sarif-sdk. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Deployment
- Documentation
- Security review use cases
- Deployment use cases
Technical details
- Install or run with Copy skill directory
When to use validate-sarif Skill
- Use it for security review.
- Use it for deployment.
- Use it for documentation.
Built with
Editorial notes
Source
- Creator: microsoft
- Repository: microsoft/sarif-sdk
- Skill file: skills/validate-sarif/SKILL.md
What it does
Validates SARIF files against the SARIF 2.1.0 schema and the AI-generated-findings profile rules shipped by Sarif.Multitool.
Skill instructions
Validate SARIF Findings Context SARIF files produced by AI security agents must conform to three layers of correctness: 1. Base schema layer — Valid SARIF 2.1.0 per the OASIS standard. Structural issues like misplaced properties, missing required fields, or type mismatches. Sarif.Multitool validate checks this. 2. Whole-log overlay layer — ai-sarif-log.schema.json, the post-enrichment output schema Sarif.Multitool get-schema serves for emit-finalize. It $refs base SARIF 2.1.0 and tightens it to the subset of Error-level AI rules JSON Schema can express at whole-log scale: the result.ruleId shape (CWE-<n/<sub-id, bare CWE-<n, or NOVEL-<sub-id), message.markdown non-empty, a physicalLocation with region.startLine = 1, a per-run versionControlProvenance (so a --no-repo log is rejected — it is unpublishable), properties[ai/origin] in the closed set, and the GHAzDO automationDetails contract when the Azure DevOps pipeline shape is present. This overlay is advisory — the contract get-schema
Explore related resources
Frequently asked questions
What is validate-sarif?
validate-sarif is a open-source AI agent skill with Copy skill directory. Validates SARIF files against the SARIF 2.1.0 schema and the AI-generated-findings profile rules shipped by Sarif.Multitool.
Who is validate-sarif best for?
validate-sarif is best for reusing agent instructions, scripts, and references, security review workflows, deployment workflows, documentation workflows.
How do I install validate-sarif?
Install or run validate-sarif using Copy skill directory. Check validate-sarif for the latest setup command.
Is validate-sarif actively maintained?
validate-sarif may need a closer maintenance check before production use.
Auto-fetched from GitHub.
