Help us improve
Share bugs, ideas, or general feedback.
From nightvision
Guide for agents to help users interpret and act on NightVision DAST scan results. Use when reading SARIF/CSV findings, explaining vulnerabilities, locating vulnerable code, validating findings with curl, prioritizing by severity, suggesting remediations, or marking false positives.
npx claudepluginhub anthropics/claude-plugins-official --plugin nightvisionHow this skill is triggered — by the user, by Claude, or both
Slash command
/nightvision:scan-triageThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill when helping users understand and act on NightVision scan results. NightVision produces findings from two scanning engines — ZAP (active and passive rules) and Nuclei (CVE and misconfiguration templates) — and exports them as SARIF or CSV.
Identifies security vulnerabilities in code and infrastructure, generates structured audit reports with severity ratings and remediation guidance. For SAST scans, secrets scanning, dependency audits, penetration testing, DevSecOps, and compliance checks.
Identifies security vulnerabilities, runs SAST scans (semgrep, bandit, gitleaks, trivy), and generates structured audit reports with severity ratings and remediation guidance.
This skill should be used when the user asks to "triage security findings", "fix a Checkmarx finding", "review SonarCloud results", "dismiss a false positive", "check code scanning alerts", or needs to work with GitHub Advanced Security alerts, scanner annotations on PRs, or Grype vulnerability results.
Share bugs, ideas, or general feedback.
Use this skill when helping users understand and act on NightVision scan results. NightVision produces findings from two scanning engines — ZAP (active and passive rules) and Nuclei (CVE and misconfiguration templates) — and exports them as SARIF or CSV.
When a user asks for help with scan results:
nightvision --help) if you need to export resultsresults.sarif or results.csv in the repo, or ask the user for the scan ID to export themRelated skills: Use scan-configuration for setting up scans, ci-cd-integration for pipeline setup, api-discovery for spec extraction.
If the user doesn't know their scan ID, list recent scans to find it:
nightvision scan list -p my-project
If the user has a scan ID but no exported file:
# SARIF with Code Traceback (API targets — provide the spec used for the scan)
nightvision export sarif -s "$SCAN_ID" --swagger-file openapi-spec.yml -o results.sarif
# SARIF without Code Traceback (WEB targets, or when no spec is available)
nightvision export sarif -s "$SCAN_ID" -o results.sarif
# CSV (flat, good for quick overview)
nightvision export csv -s "$SCAN_ID" -o results.csv
--swagger-file is optional. When provided, SARIF output includes Code Traceback source annotations (file/line mappings). When omitted, the SARIF is still valid but won't contain source code locations.
SARIF (Static Analysis Results Interchange Format) is JSON. Key structure:
runs[0].tool.driver.rules[] — vulnerability type definitions
runs[0].results[] — individual finding instances
.ruleId — maps to rules[] for description
.level — "error" (high), "warning" (medium), "note" (low/info)
.message.text — human-readable finding summary
.locations[].physicalLocation — file path and line (Code Traceback)
.properties — NightVision-specific metadata
The agent should read the SARIF JSON, iterate over results[], and explain each finding using the corresponding rules[] entry.
When API Discovery generated the OpenAPI spec, it annotated endpoints with source file paths and line numbers. These appear in SARIF as physicalLocation entries, letting the agent navigate directly to the vulnerable code:
"locations": [{
"physicalLocation": {
"artifactLocation": { "uri": "src/main/java/api/UserController.java" },
"region": { "startLine": 42 }
}
}]
The agent should read that file and show the user the vulnerable code in context.
CSV columns: finding_name, kind_id, id, url, path, method, parameter, payload, evidence, severity, ai_explanation
Key fields for triage:
| Severity | Meaning | Agent action |
|---|---|---|
| High | Exploitable, significant impact (data breach, RCE, auth bypass) | Fix immediately, explain the attack scenario |
| Medium | Exploitable but lower impact, or requires specific conditions | Fix soon, explain the risk |
| Low | Minor issues, information leaks, best practice violations | Fix when convenient, explain the hygiene benefit |
| Informational | Observations, not directly exploitable | Mention if relevant, don't alarm |
NightVision's web UI provides a "Validate with curl" button. The agent can construct equivalent curl commands from the SARIF/CSV data:
# From CSV fields: method, url, parameter, payload
curl -X POST "https://api.example.com/login" \
-d "username=admin' OR '1'='1&password=test" \
-v
The response should contain the evidence that confirms the vulnerability. Show the user the relevant part of the response.
See references/vulnerability-guide.md for a reference of common finding types, what they mean, and how to fix them.
SQL Injection (CWE-89) — User input reaches a SQL query without parameterization.
Cross-Site Scripting / XSS (CWE-79) — User input is reflected in HTML without encoding.
Server-Side Request Forgery / SSRF (CWE-918) — User input controls a server-side HTTP request target.
Remote Code Execution / RCE (CWE-94) — User input is executed as code on the server.
Path Traversal (CWE-22) — User input accesses files outside intended directories.
Broken Authentication (CWE-287) — Authentication mechanisms can be bypassed or exploited.
Guide the user through this decision:
If the finding is a false positive, the user can mark it in the NightVision web UI (app.nightvision.net) under the scan results. Status options: Open, False Positive, Resolved.
ZAP Active Rules — Sends attack payloads to test for exploitable vulnerabilities. Covers SQL injection variants, XSS types, RCE, SSTI, Log4Shell, JWT attacks, directory traversal, and more.
ZAP Passive Rules — Analyzes responses without attacking. Detects missing security headers, cookie misconfigurations, information leaks, CSRF token absence, credential exposure.
Nuclei Templates — Template-based detection of known CVEs and misconfigurations.
Specific rules can be disabled per scan with --disable-zap-active-alerts <ids> or --disable-nuclei-folders <paths>, or entire engines with --no-zap / --no-nuclei.