# Vulnerability Triage Brocards

Should be used when the user asks to "triage a vulnerability report", "assess a CVE"...

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Security
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add trailofbits/skills --skill vulnerability-triage-brocards -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill vulnerability-triage-brocards -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill vulnerability-triage-brocards -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill vulnerability-triage-brocards -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Vulnerability Triage Brocards

Systematically evaluate incoming vulnerability reports against 7 principled
criteria before committing resources to deeper analysis. Each brocard is a
falsifiable test: if a report fails any brocard, document the reason and
dismiss or request clarification. If a report survives all 7, escalate it.

The 7 brocards are adapted from William Woodruff's
["Brocards for vulnerability triage"](https://vulnbrocards.com/)
(2026).

## When to Use

- Filtering findings from agentic vulnerability discovery pipelines
  before human review -- the primary use case; most automated runs
  produce findings that fail one or more brocards and can be dismissed
  without auditor time
- Triaging findings during a ToB audit to decide which warrant
  escalation to PoC development
- Evaluating third-party CVEs or advisories against a codebase under
  active audit to decide if they affect engagement scope
- Reviewing bug bounty submissions or external vulnerability reports
  for ToB open-source projects
- Providing structured, defensible justification when recommending a
  client dismiss or deprioritize a reported CVE

## When NOT to Use

- **Hunting for new bugs during an audit** -- use other skills
- **Proving exploitability of a confirmed finding** -- use a
  dedicated PoC/exploitability skill
- **Triaging fuzzer crashes in C/C++** -- use a dedicated crash
  triage skill

## Pipeline Position

This skill is the quality gate between automated discovery and human
review. Findings that survive triage proceed to PoC development and
formal writeup.

```mermaid
flowchart TD
    A([agentic vulnerability discovery]) -->|raw findings| B[vulnerability-triage-brocards]
    B -->|DISMISS| C([Document brocard # and reasoning])
    B -->|NEEDS-MORE-INFO| D([Request specific evidence])
    B -->|ACCEPT| E[PoC / exploitability proof]
    E --> F[vulnerability report writeup]
```

## Triage Workflow

The rest: https://github.com/trailofbits/skills/blob/HEAD/plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards/SKILL.md