Triage
Triage a batch of raw security findings.
Install
npx skills add anthropics/defending-code-reference-harness --skill triage -g -a claude-code -y- Repository
- anthropics/defending-code-reference-harness7.7k
- Category
- Security
- Updated
- 3mo ago
- License
- See repository
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output and writes TRIAGE.json + TRIAGE.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the backlog". Runs interactively by default; pass --auto to skip the interview.
triage
Adversarial triage of raw security-scanner output. Does four jobs: verify each finding is real, deduplicate across runs and scanners, rank survivors by derived exploitability rather than the scanner's claimed severity, and route each to a component owner. Output is a short, ranked, owned list instead of a raw dump.
Invoke with /triage <findings-path> [--auto] [--votes N] [--repo PATH] [--fp-rules FILE].
Arguments (parse from $ARGUMENTS; positional $1/$2 expansion is
not stable across runtimes):
- findings path (first positional, required): a JSON file, a directory of
JSON files, a
VULN-FINDINGS.json, anINCIDENTS.json, a pipelineresults/<target>/<ts>/directory, or a markdown report. --auto: skip the interview and use defaults. Default mode is interactive.--votes N: verifier votes per finding (default 3; use 1 for a quick pass, 5 for high-stakes batches).--repo PATH: path to the target codebase, read-only (default cwd). Verification needs source access; the skill stops with an error if the cited files aren't reachable.--fp-rules FILE: append the contents of FILE to the verifier's exclusion-rule list (Phase 3a). Use for org-specific precedents: "we use Prisma ORM everywhere, raw-query SQLi only", "k8s resource limits cover DoS", etc. Plain text, one rule per line or paragraph.--fresh: ignore any existing checkpoint in./.triage-state/and start from Phase 0. Without this flag the skill resumes from the last completed phase if a checkpoint is present.
Tools: Read, Glob, Grep, Write, Task, AskUserQuestion. Bash is
permitted only for git, find, wc, ls, jq, and
python3 .claude/skills/_lib/checkpoint.py (checkpoint I/O).
