菜单
Export security review results to Markdown and SARIF report formats. Use when the user wants to save, export, or generate reports from security review findings produced by /secdevai review, /secdevai fix, or /secdevai tool.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | secdevai-export |
| description | Export security review results to Markdown and SARIF report formats. Use when the user wants to save, export, or generate reports from security review findings produced by /secdevai review, /secdevai fix, or /secdevai tool. |
Alias for /secdevai export - Export security review results to Markdown and SARIF formats.
/secdevai-export json # Export from a JSON results file
/secdevai export json # Same via main command
This is an alias for /secdevai export. See the main /secdevai command documentation for full details.
When invoked, this command:
secdevai-results, or $SECDEVAI_RESULTS_DIR if set)secdevai-<type>-YYYYMMDD_HHMMSS.md and .sarifThe export logic lives in scripts/results_exporter.py within this skill directory. It provides:
export_results(data, result_dir, command_type) - Main entry pointconvert_to_markdown(data) - Convert findings to Markdownconvert_to_sarif(data) - Convert findings to SARIF 2.1.0from pathlib import Path
import importlib.util
# Load the exporter from the deployed skill scripts
script_path = Path("secdevai-export/scripts/results_exporter.py")
spec = importlib.util.spec_from_file_location("results_exporter", script_path)
mod = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mod)
# Export to markdown and SARIF
markdown_path, sarif_path = mod.export_results(data, command_type="review")
The data dictionary should follow this structure:
{
"metadata": {
"tool": "secdevai-ai-analysis",
"version": "1.0.0",
"timestamp": "ISO 8601 timestamp",
"target_file": "file path or 'codebase'",
"analyzer": "AI Security Review"
},
"summary": {
"total_findings": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"info": 0
},
"findings": [],
"affected_endpoints": [],
"recommendations": {
"immediate_actions": [],
"long_term_improvements": []
}
}
See /secdevai command documentation. This alias executes /secdevai export with the same behavior.
Important:
secdevai-results)SECDEVAI_RESULTS_DIR in your shell profile to use a custom base directory without retyping it each run — the prompt will show your value as the default. This env var is shared by all secdevai commands (review, fix, tool, dast).secdevai-<type>-YYYYMMDD_HHMMSS.md and .sarifRun external security analysis tools (Bandit, Gosec, Scorecard, Semgrep) inside read-only containers via podman/docker. Use when the user wants to execute specific security tools, combine their output with AI analysis, or run all available tools at once.
Perform AI-powered security code review using OWASP Top 10, CWE/SANS Top 25, and WSTG patterns. Use when reviewing source code, specific files, git commits, or entire codebases for security vulnerabilities. Supports web and non-web code (C/C++, Go, Rust, etc.), multi-language analysis, severity classification, and automated finding validation via subagent.
AI-powered secure development assistant. Dispatches to review, fix, tool, and export subcommands. Use when the user invokes /secdevai with no subcommand or needs an overview of available security commands.
Validate security findings for exploitability, severity accuracy, and CVSS scoring. Use when secdevai-review dispatches findings for validation, or when the user invokes /secdevai validate to re-validate prior results. Rejects false positives, calibrates severity to Red Hat classification, and produces per-finding CVSS v3.1 analysis.
Dynamic Application Security Testing (DAST) using RapiDAST and ZAP. Use when the user wants to scan a running web app or API for security vulnerabilities, run a DAST scan, test a service endpoint, use RapiDAST or ZAP, or says "/secdevai dast" or "/secdevai-dast". Auto-detects Dockerfile/Compose for containerized targets, finds OpenAPI specs, guides the full scan workflow from target setup through SARIF result export, and — uniquely — traces each DAST finding back to the exact source file and line that is the root cause.
Display all available SecDevAI commands, usage examples, aliases, and configuration options. Use when the user asks for help, needs a command reference, or wants to see the typical security review workflow.