Vulnerability Triage Brocards
Should be used when the user asks to "triage a vulnerability report", "assess a CVE"...
Install
npx skills add trailofbits/skills --skill vulnerability-triage-brocards -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Security
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Mediumabout 2,012 tokens
- Runs scripts
- No, instructions only
What it does
This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.
Vulnerability Triage Brocards
Systematically evaluate incoming vulnerability reports against 7 principled criteria before committing resources to deeper analysis. Each brocard is a falsifiable test: if a report fails any brocard, document the reason and dismiss or request clarification. If a report survives all 7, escalate it.
The 7 brocards are adapted from William Woodruff's "Brocards for vulnerability triage" (2026).
When to Use
- Filtering findings from agentic vulnerability discovery pipelines before human review -- the primary use case; most automated runs produce findings that fail one or more brocards and can be dismissed without auditor time
- Triaging findings during a ToB audit to decide which warrant escalation to PoC development
- Evaluating third-party CVEs or advisories against a codebase under active audit to decide if they affect engagement scope
- Reviewing bug bounty submissions or external vulnerability reports for ToB open-source projects
- Providing structured, defensible justification when recommending a client dismiss or deprioritize a reported CVE
When NOT to Use
- Hunting for new bugs during an audit -- use other skills
- Proving exploitability of a confirmed finding -- use a dedicated PoC/exploitability skill
- Triaging fuzzer crashes in C/C++ -- use a dedicated crash triage skill
Pipeline Position
This skill is the quality gate between automated discovery and human review. Findings that survive triage proceed to PoC development and formal writeup.
flowchart TD
A([agentic vulnerability discovery]) -->|raw findings| B[vulnerability-triage-brocards]
B -->|DISMISS| C([Document brocard # and reasoning])
B -->|NEEDS-MORE-INFO| D([Request specific evidence])
B -->|ACCEPT| E[PoC / exploitability proof]
E --> F[vulnerability report writeup]
