Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →lifinance/aikido-address-findings
Full Aikido triage for a PR or repo. In PR scope (default) it reads the aikido-pr-checks[bot] inline review comments on the PR; in repo/single-issue scope it reads the aikido_issues_list feed. Identifies false positives and real findings, ignores false positives (by replying "@AikidoSec ignore:" on the PR comment, or via aikido_ignore_issue for feed scope), applies code fixes for real findings (NoSQL injection, GH Actions template injection, vulnerable dependencies, unpinned Actions), and option
Passed 11 of 16 test cases with the skill, and 3 of 16 without it.
and 17 more in the full report
12 fixed3 passed either way6 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
During triage, a finding on `src/util.ts` looks like a false positive to the reviewer, but it does not match any entry in `.agents/references/aikido-false-positive-catalog.md`. What recommendation should be assigned?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns a recommendation of Manual review | Missed | Passed |
| Offers the command /aikido-update-false-positive-catalog to add the new pattern | Missed | Passed |
The instructions your model reads when the skill loads.
Single entry point for all Aikido triage. Handles both false positives (ignore + SAST context) and real findings (code fixes), scoped to the current PR, a single finding, or the whole repo.
The first argument selects scope (default pr). A second optional argument overrides the repo name (default: the current git repo).
| Argument | Scope | Source of findings |
|---|---|---|
(none) or pr | Findings on the current branch's open PR | aikido-pr-checks[bot] inline review comments on the PR |
all | Every open SAST finding in the repo | aikido_issues_list feed (no filter) |
<issue-id> (numeric) | One specific finding | aikido_issues_list feed, filtered to that issue_id |
The two scopes use different identifiers and different ignore mechanisms: pr works off PR review-comment IDs and ignores via a GitHub comment reply; all/<issue-id> work off Aikido feed issue_ids and ignore via the MCP. They don't mix.
pr mode: needs gh authenticated against the PR's repo. No MCP call required — the findings come from PR comments.all / <issue-id> mode: needs the Aikido MCP. Verify with aikido-mcp:aikido_full_scan on [{ relativeFilePath: "test.js", content: "// test" }]. If it fails or is missing, stop:
The Aikido MCP server is not available or not authenticated. Run
/aikido:setup— get your API key from https://app.aikido.dev → Settings → Integrations → IDE Plugins, then restart Claude Code.
pr mode (default) — read the PR bot commentsThe Aikido GitHub app (aikido-pr-checks[bot]) scans the PR diff and posts one inline review comment per finding. These are authoritative for the PR — use them, not the feed. The feed is tagged to main and both misses findings the PR introduces and includes main findings on files the PR doesn't touch.
Resolve the PR. gh pr view --json number,url finds the PR for the current branch. If it prints "no pull requests found" — you're not on the PR's head branch (e.g. testing from another branch) — ask the user for the PR number or URL; do not guess. Owner/repo come from gh automatically (the origin remote). Never hardcode the repo: this repo and its upstream share most code under different Aikido repo names (contracts-tron vs contracts), so querying the wrong one returns the wrong findings.
Fetch the bot's findings — they are review comments, not issue comments, and each finding root has in_reply_to_id == null:
gh api repos/{owner}/{repo}/pulls/<N>/comments --paginate \
test cases passed, vs 3 / 16 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.