pixee-finding
starsforks
How to install pixee-finding?
pixee/pixee-cli/pixee-finding
$npx -y skills add pixee/pixee-cli --skill pixee-findingList, filter, and view Pixee findings for a scan with aggregate counts across triage, fix, and SCA outcomes.
SKILL.md
| 1 | # pixee finding |
| 2 | |
| 3 | > **PREREQUISITES:** Read `../pixee-shared/SKILL.md` for global flags, exit codes, and error |
| 4 | > handling, and `../pixee-scan/SKILL.md` to discover the `--scan` UUID this skill requires. |
| 5 | |
| 6 | `pixee finding` lists and views findings produced by a scan. A finding hangs off a single scan and |
| 7 | is not addressable on its own, so every invocation requires `--scan <scan-id>`. Findings carry the |
| 8 | output of every analysis Pixee runs against them — triage, fix, sca — and the CLI inlines the |
| 9 | representative result for each analysis type so an agent rarely needs a second HTTP call. |
| 10 | |
| 11 | Before asking the user which repository, branch, scan, or pull request to target, derive that |
| 12 | context from the working environment with whatever facilities the host agent already has — current |
| 13 | directory, git state, PR tooling, project conventions. The user is almost always asking about |
| 14 | findings tied to wherever `cwd` already points. Use `pixee scan list --repo <name-or-uuid>` (with |
| 15 | `--branch` and `--tool` to narrow) to pin down the scan UUID, and only fall back to asking when the |
| 16 | derivation comes back empty or ambiguous. |
| 17 | |
| 18 | ## pixee finding list |
| 19 | |
| 20 | ``` |
| 21 | pixee finding list --scan <scan-id> [filter flags...] |
| 22 | ``` |
| 23 | |
| 24 | `--scan` is **required**. The response always carries cross-section aggregate counts (triage |
| 25 | status/outcome, fix status/outcome/confidence, sca status/classification, and the composite |
| 26 | `ready_to_fix` / `no_fix_necessary` views) plus, by default, the paginated `items` list with each |
| 27 | item's representative analysis results inlined. |
| 28 | |
| 29 | Text output is the aggregate table only — one tab-separated `key\tvalue` row per metric. Items are |
| 30 | not surfaced in text mode; use `--json` to access them. The JSON shape: |
| 31 | |
| 32 | - Top-level aggregate fields: `total`, `completed_analysis`, `in_progress_analysis`, `triage`, |
| 33 | `fix`, `sca`, `composite`, `page`, `_links`. |
| 34 | - `_embedded.items[]` carries the paginated findings (omitted under `--stats`). Each item has |
| 35 | `id`, `title`, `rule`, `severity` (`{label, rank}`), `html_url`, `_links`, and |
| 36 | `_embedded["representative-results"]` — a paginated wrapper whose own `_embedded.items[]` |
| 37 | contains one entry per analysis `type` (`triage`, `fix`, `sca`) with self/finding/analysis links |
| 38 | and, for fix results, `changesets`, `patches`, and a one-page `latest-patch` shortcut. |
| 39 | |
| 40 | Pagination is transparent: the CLI walks every page of findings in one call. Aggregate counts are |
| 41 | page-invariant for a given filter set, so `--stats` (below) returns them in a single HTTP |
| 42 | round-trip. |
| 43 | |
| 44 | ### `--stats` |
| 45 | |
| 46 | ``` |
| 47 | pixee finding list --scan <scan-id> --stats [filter flags...] |
| 48 | ``` |
| 49 | |
| 50 | Returns aggregate counts only, dropping `_embedded.items`. Sends `page-size=1` over the wire so it |
| 51 | answers questions like "how many critical findings have a completed fix on this scan?" without |
| 52 | streaming the items page. Combine with filter flags below to scope the counts. |
| 53 | |
| 54 | ### Filter flags |
| 55 | |
| 56 | All filters are **repeatable** unless noted, and combine as AND across distinct flags / OR within |
| 57 | the same flag. |
| 58 | |
| 59 | - `--severity <label>` — filter by representative severity label. |
| 60 | - `--suggested-severity <label>` — filter by triage's suggested severity label. |
| 61 | - `--min-severity-score <num>` / `--max-severity-score <num>` — bound the severity score (0.0–10.0). |
| 62 | Not repeatable. |
| 63 | - `--triage-status <s>` — one of `completed`, `failed`, `no-recommendations-available`. |
| 64 | - `--triage-suggested <s>` — one of `true_positive`, `likely_true_positive`, `inconclusive`, |
| 65 | `false_positive`, `wont_fix`, `blocked`, `excluded`, `not_triaged`. |
| 66 | - `--fix-status <s>` — one of `completed`, `failed`, `no-recommendations-available`, `blocked`, |
| 67 | `excluded`. |
| 68 | - `--fix-confidence <s>` — one of `high`, `medium`, `low`, `no-rating`. |
| 69 | - `--sca-status <s>` — one of `completed`, `failed`, `blocked`, `excluded`, `not-analyzed`. |
| 70 | - `--sca-classification <s>` — one of `exploitable`, `not-exploitable`, `inconclusive`. |
| 71 | - `--patch-status <s>` — one of `issued`, `merged`. |
| 72 | - `--severity-update <s>` — one of `increased`, `decreased`, `no_update`. Filters by the |
| 73 | severity-update relation. |
| 74 | - `--analyzed` — only fully-analyzed findings (every analysis type has reached a terminal state). |
| 75 | - `--no-analyzed` — only not-fully-analyzed findings. |
| 76 | - `--view validated` — composite view filter. Currently only `validated` is defined. |
| 77 | - `--query <text>` — case-insensitive search across finding id, title, rule, and file path. |
| 78 | - `--sort <field>` — `pixee-intelligence` (default), `severity`, or `pixee-severity`. |
| 79 | - `--order <asc|desc>` — sort direction. Default `desc`. |
| 80 | |
| 81 | ## pixee finding view |
| 82 | |
| 83 | ``` |
| 84 | pixee finding view <finding-id> --scan <scan-id> |
| 85 | ``` |
| 86 | |
| 87 | `<finding-id>` is the finding's scan-scoped id, surfaced in `_embedded.items[].id` from |
| 88 | `pixee finding |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
