vulnerability-triage-brocards
>- This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission",…
About
>-
This skill should be used when the user asks to "triage a vulnerability
report", "assess a CVE", "evaluate a bug bounty submission", "decide if a
finding is valid", "review a security finding", "dismiss a vulnerability",
"should we fix this CVE", "prioritize a vulnerability report", or needs
to determine whether an incoming vulnerability report warrants
investigation. Applies 7 brocards (rules of thumb) to systematically
accept, dismiss, or request more information on vulnerability reports,
or needs to filter raw findings from agentic vulnerability
discovery pipelines before human review.
What it can do
- >-
- This skill should be used when the user asks to "triage a vulnerability
- report", "assess a CVE", "evaluate a bug bounty submission", "decide if a
- finding is valid", "review a security finding", "dismiss a vulnerability",
- "should we fix this CVE", "prioritize a vulnerability report", or needs
- to determine whether an incoming vulnerability report warrants
- investigation. Applies 7 brocards (rules of thumb) to systematically
- accept, dismiss, or request more information on vulnerability reports,
- or needs to filter raw findings from agentic vulnerability
- discovery pipelines befo
Setup
- Install:
npx skills add trailofbits/skills --all - The skill auto-loads when relevant, or invoke it by name in your agent.
Prerequisites
A compatible AI coding agent (Claude Code, Cursor, etc.).
Use cases
Works with
Trust score — 9/10
Trail of Bits is a top-tier security research firm; their skills are professional-grade auditing and fuzzing playbooks used by their own engineers. Open source.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.