Fixtures are fake, non-sensitive sample inputs under fixtures/.
Used for:
manual CLI runs
README examples
smoke tests
parser/reviewer examples
future workflow golden tests
no real customer data
no real credentials/tokens
no real incident artifacts
no proprietary logs
use example.com/example.net/example.org
use documentation IP ranges
keep files small and reviewable
name malformed samples clearly
fixtures/browser-extension/ plugin-browser-extension parser, reviewer, scorer, finding, and workflow
fixtures/certificates/ plugin-certificates parser, reviewer, and workflow fixtures
fixtures/csv/ parse_csv
fixtures/dockerfile/ parse_dockerfile
fixtures/email/ plugin-email parser and reviewer fixtures
fixtures/github-actions/ parse_github_actions_workflow
fixtures/http-headers/ parse_http_headers
fixtures/ip-prefixes/ parse_ip_prefix_list
fixtures/asn/ ASN parser fixtures, RIR delegated stats, and network registry normalization, lookup, and review examples
fixtures/identifiers/ extract_cves, extract_uuids
fixtures/iocs/ shared IOC helpers plus plugin-url-triage extraction and review fixtures
fixtures/jwt/ parse_jwt, review_jwt
fixtures/lockfiles/ plugin-packages lockfile parser, reviewer, and workflow
fixtures/mac-oui/ parse_mac_address_lists, parse_oui_registry_snapshots, normalize_oui_registry_snapshot, lookup_mac_vendor_local
fixtures/sbom/ plugin-sbom parser, reviewer, and workflow
fixtures/package-json/ plugin-packages manifest parser, reviewer, and workflow
fixtures/sarif/ plugin-scanner-normalize SARIF parser and static-analysis workflow
fixtures/scanners/ plugin-scanner-normalize native scanner parsers and normalization
fixtures/trufflehog/ plugin-scanner-normalize TruffleHog parser
fixtures/urls/ URL/IOC extraction
fixtures/yaml/ parse_yaml
security-workbench skills run parse_sarif --input-file "$PWD/fixtures/sarif/codeql-results.sarif" --format pretty
security-workbench skills run parse_trufflehog_ndjson --input-file "$PWD/fixtures/trufflehog/git-results.ndjson" --format pretty
security-workbench skills run parse_semgrep_json --input-file "$PWD/fixtures/scanners/semgrep-results.json" --format pretty
security-workbench skills run parse_checkov_json --input-file "$PWD/fixtures/scanners/checkov-results.json" --format pretty
security-workbench skills run parse_grype_json --input-file "$PWD/fixtures/scanners/grype-results.json" --format pretty
security-workbench skills run parse_pem_certificate --input-file "$PWD/fixtures/certificates/example-cert.pem" --format pretty
security-workbench skills run parse_lockfiles --input-file "$PWD/fixtures/lockfiles/package-lock.json" --format pretty
security-workbench skills run parse_sbom --input-file "$PWD/fixtures/sbom/cyclonedx.json" --format pretty
security-workbench skills run parse_github_actions_workflow --input-file "$PWD/fixtures/github-actions/basic-workflow.yml" --format pretty
security-workbench skills run parse_dockerfile --input-file "$PWD/fixtures/dockerfile/multi-stage.Dockerfile" --format pretty
security-workbench skills run parse_http_headers --input-file "$PWD/fixtures/http-headers/security-headers.txt" --format pretty
security-workbench skills run parse_browser_extension_manifest --input-file "$PWD/fixtures/browser-extension/manifest-v3-basic.json" --format pretty
security-workbench skills run parse_csv --input-file "$PWD/fixtures/csv/assets.csv" --format pretty
security-workbench skills run parse_yaml --input-file "$PWD/fixtures/yaml/app-config.yaml" --format pretty
security-workbench skills run parse_package_json --input-file "$PWD/fixtures/package-json/basic-package.json" --format pretty
security-workbench skills run parse_ip_prefix_list --input-file "$PWD/fixtures/ip-prefixes/mixed-prefixes.txt" --format pretty
security-workbench skills run parse_asn_list --input-file "$PWD/fixtures/asn/asn-list.txt" --format pretty
security-workbench skills run parse_asn_allow_deny_list --input-file "$PWD/fixtures/asn/asn-allow-deny-list.txt" --format pretty
security-workbench skills run parse_asn_observations --input-file "$PWD/fixtures/asn/asn-observations.txt" --format pretty
security-workbench skills run parse_bgp_prefix_table --input-file "$PWD/fixtures/asn/bgp-prefix-table.txt" --format pretty
security-workbench skills run parse_rir_delegated_stats --input-file "$PWD/fixtures/asn/rir-delegated-stats.txt" --format pretty
security-workbench skills run parse_routeviews_prefix2as_snapshot --input-file "$PWD/fixtures/asn/routeviews-prefix2as-snapshot.txt" --format pretty
security-workbench skills run normalize_network_registry_snapshot --input-file "$PWD/fixtures/asn/network-registry-snapshot.json" --format pretty
security-workbench skills run lookup_ip_prefix_membership_local --input-file "$PWD/fixtures/asn/network-registry-ip-lookup-input.json" --format pretty
security-workbench skills run lookup_ip_prefix_membership_local --input-file "$PWD/fixtures/asn/network-registry-ip-lookup-input.json" > /tmp/ip-prefix-membership.lookup.json
security-workbench skills run review_prefix_membership --input-file /tmp/ip-prefix-membership.lookup.json --format pretty
security-workbench skills run lookup_asn_membership_local --input-file "$PWD/fixtures/asn/network-registry-asn-lookup-input.json" --format pretty
security-workbench skills run lookup_asn_membership_local --input-file "$PWD/fixtures/asn/network-registry-asn-lookup-input.json" > /tmp/asn-membership.lookup.json
security-workbench skills run review_asn_membership --input-file /tmp/asn-membership.lookup.json --format pretty
security-workbench skills run parse_mac_address_lists --input-file "$PWD/fixtures/mac-oui/mac-address-list.txt" --format pretty
security-workbench skills run parse_oui_registry_snapshots --input-file "$PWD/fixtures/mac-oui/oui-registry-snapshot.txt" --format pretty
security-workbench skills run normalize_oui_registry_snapshot --input-file "$PWD/fixtures/mac-oui/oui-registry-snapshot.txt" --format pretty
security-workbench skills run lookup_mac_vendor_local --input-file "$PWD/fixtures/mac-oui/mac-vendor-lookup-input.json" --format pretty
security-workbench skills run parse_jwt --input-file "$PWD/fixtures/jwt/alg-none.jwt" --format pretty
security-workbench skills run parse_jwt --input-file "$PWD/fixtures/jwt/alg-none.jwt" > /tmp/jwt.parsed.json
security-workbench skills run review_jwt --input-file /tmp/jwt.parsed.json --format pretty
security-workbench skills run extract_iocs --input-file "$PWD/fixtures/iocs/mixed-iocs.txt" --format pretty
security-workbench skills run normalize_indicators --input-file "$PWD/fixtures/iocs/defanged-indicators.txt" --format pretty
security-workbench skills run extract_defanged_urls --input-file "$PWD/fixtures/iocs/defanged-indicators.txt" --format prettyUse $PWD/... when examples should resolve from the current repo checkout.
fixtures/ shared repo examples and current smoke inputs
plugins/<plugin>/testdata/ plugin-specific golden inputs
packages/<package>/testdata/ package-specific golden inputs
Root-level fixtures are acceptable for current smoke and documentation examples. Self-contained plugin fixtures are a release-hardening goal for plugin packages that need to be tested, validated, or distributed independently.