codebase-semgrep-findings-reviewlisted

Review each finding from a Semgrep output file and determine whether it is a real issue, a false positive, or requires human review. The objective is to apply **semantic reasoning** to every Semgrep finding: read the flagged code location and its surrounding context, understand what the code actually does, and decide whether the pattern match reflects a genuine security weakness or a false positive that a purely syntactic rule cannot distinguish. Parse `$ARGUMENTS` as follows: - **First token**: path to the Semgrep output file (SARIF `.sarif` or JSON `.json` format). Required. - **Second token** (optional): base directory of the source code under review. All relative file paths extracted from the Semgrep output are resolved against this root. Default: `.` (current working directory). If the second token is exactly `CONFIRMED` or `PARTIAL` it is treated as the min-confidence threshold instead (backward-compatible shorthand when no source root is needed). - **Third token** (optional): minimum confidence threshold for inclusion in output. Accepted values: `CONFIRMED` (only confirmed findings) or `PARTIAL` (confirmed + needs-human-review findings). Default: `PARTIAL`. `FALSE_POSITIVE` verdicts are always excluded from the findings list but are recorded in the summary table. ## Scope If no file path is provided in `$ARGUMENTS`, exit immediately with: `Error: a Semgrep output file path is required. Usage: /codebase-semgrep-findings-review <path-to-sarif-or-json> [source-root]