CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/snyk-test

Configures and runs Snyk, a commercial multi-mode scanner: snyk test for SCA (dependency scanning), snyk code test for SAST (code security scanning), snyk container test for container images, snyk iac test for IaC (infrastructure-as-code), snyk monitor for continuous new-vuln alerts; policy file .snyk for ignore + patch. Use when the team has a Snyk license and needs SCA (dependency scanning) or continuous vuln monitoring; for open-source scanning without a Snyk license, prefer osv-scanner.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

snyk-policy-and-triage.mdreferences/

Snyk .snyk policy and false-positive triage

.snyk policy file

Per Snyk's policy-file model (consult docs.snyk.io for current schema), .snyk lives at the project root and supports:

# .snyk
version: v1.0.0
ignore:
  SNYK-JS-LODASH-567746:
    - '*':
        reason: "False positive; we don't pass user input to Lodash sortBy"
        expires: '2026-12-15T00:00:00.000Z'
        created: '2026-05-15T00:00:00.000Z'
patch: {}

Per-vuln ignore can be scoped to specific paths (* > lodash, my-package > lodash) and must include an expires: field - Snyk policy validates this at scan time.

False-positive triage (MANDATORY)

Three suppression layers:

MechanismWhereUse
.snyk policy file ignore (with expiration)Repo rootPer-vuln + per-path; auditable in git history
Snyk dashboard "Ignore" actionsnyk.io/appOrg-wide; persistent; reviewer-tracked
--severity-threshold= filterCI flagScan-time noise reduction (not suppression)
--fail-on=upgradable flagCI flagOnly fail if a fix exists; soft gate

Justification template (mandatory in .snyk):

ignore:
  SNYK-JS-LODASH-567746:
    - '*':
        reason: |
          Reason: Lodash sortBy not exposed to user input;
          attack path requires admin context which is separately
          controlled. Verified in code review (PR #1234).
        approved-by: alice@example.com
        expires: '2026-12-15T00:00:00.000Z'
        created: '2026-05-15T00:00:00.000Z'
        re-review-date: '2026-09-15T00:00:00.000Z'

Cadence: every quarter, list .snyk policies grouped by re-review-date and process expired entries.

references

snyk-policy-and-triage.md

SKILL.md

tile.json