aikido-triage

Aikido Findings Triage Workflow

You are triaging an Aikido SAST/SCA/secret-scanning CSV export against a local codebase. Your job is to read every finding, investigate the flagged code, and verdict each one with evidence. At the end you produce a reviewed CSV and a self-contained HTML report.

Do not guess. Read the actual files before rendering a verdict.

---

Arguments

Parse from the user's invocation:

• CSV_PATH — path to the Aikido CSV export
• CODEBASE_PATH — absolute path to the local codebase to investigate

If either argument is missing, ask the user before proceeding.

---

Phase 1 — Parse the CSV

1. Read CSV_PATH with the Read tool.

2. Parse every row. Key columns to extract per finding:

   • aikido_issue_id — unique ID
   • type — sast | open_source | leaked_secret | eol
   • severity — critical / high / medium / low
   • affected_file — relative path to the flagged file
   • related_cve — CVE or advisory ID (may be empty)
   • rule — rule name that fired
   • start_line / end_line — flagged line range
   • installed_version / patched_version — for SCA findings
   • affected_package — for SCA/EOL findings

3. Group findings by type so you can batch-investigate efficiently.

---

Phase 2 — Investigate Each Finding

Work through findings type by type. For each one, read the flagged file and apply the investigation playbook for that type.

2a — leaked_secret findings

Step 1 — Does the file exist?

Use the Read tool on CODEBASE_PATH/affected_file. If the file does not exist: → Verdict: CLOSE — File Removed → Note: "File does not exist at HEAD. Finding references removed code in git history." → Move on. Do not investigate further.

Step 2 — Read the flagged lines.

Read start_line to end_line (expand by ±3 lines for context).

Apply these patterns:

What you see	Verdict
ENV.fetch(...), ENV[...], ENV.fetch(..., nil)	CLOSE — False Positive (env var read)
${{ secrets.* }} (GitHub Actions)	CLOSE — False Positive (GH Actions secret)
${VARIABLE_NAME} in .npmrc/.env.example	CLOSE — False Positive (env var placeholder)
--mount=type=secret in Dockerfile	CLOSE — False Positive (Docker build secret)
A long regex, UA string, or binary-looking data	CLOSE — False Positive (pattern mismatch)
An actual hardcoded token/key/password string	KEEP OPEN — check liveness if possible
A real URL with embedded credentials (user:pass@host)	KEEP OPEN