# Triage Finding

Deduplicate, prioritize, and sanity-check a list of raw scanner findings.

- Repository: https://github.com/vigolium/vigolium (1141 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-25
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add vigolium/vigolium --skill triage-finding -g -a claude-code -y`
Codex: `npx skills add vigolium/vigolium --skill triage-finding -g -a codex -y`
Cursor: `npx skills add vigolium/vigolium --skill triage-finding -g -a cursor -y`
Gemini CLI: `npx skills add vigolium/vigolium --skill triage-finding -g -a gemini-cli -y`

## Description

Deduplicate, prioritize, and sanity-check a list of raw scanner findings. Use after a dynamic scan completes or when the user asks to review a findings dump. Produces a triaged list with severity adjustments, false-positive calls, and exploitability notes.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Finding Triage

You are triaging scanner findings. The input is a list of raw findings
produced by native scanners or earlier agent passes. Your job is to turn
that noisy list into a decision-quality report.

## What triage means here

For each finding, decide one of:

- **Keep as-is**, concrete bug, severity accurate, ready to report.
- **Keep + adjust**, real bug but severity is wrong given the context
  (e.g., reflected XSS on a login-required admin endpoint isn't critical).
- **Duplicate**, same root cause as another finding. Mark secondary
  copies as duplicates of the canonical one; don't re-report them.
- **False positive**, the scanner was wrong. State the specific reason
  (e.g., "the payload was reflected inside a `<script>` block that is
  JSON-parsed, not executed").
- **Needs PoC**, plausible but unverified. Outline what a proof-of-concept
  would look like; don't fabricate evidence.

## Severity calibration

Use this rubric. Downgrade if the exploit preconditions are not met.

| Severity | Meaning | Preconditions that DOWNGRADE |
|----------|---------|------------------------------|
| critical | Unauthenticated RCE / auth bypass on primary user path | Requires admin; requires ≥2 other bugs chained |
| high     | Auth bypass, stored XSS on primary path, SQLi with data exfil | Requires local access; reflected-only on low-traffic path |
| medium   | Reflected XSS, IDOR with limited blast radius, insecure deserialization | Requires elevated role; narrow path |
| low      | Info leak without sensitive data, weak TLS config | Covered by WAF / CSP in a way that neutralizes it |

## Recommended workflow

The rest: https://github.com/vigolium/vigolium/blob/HEAD/internal/resources/olium/skills/triage-finding/SKILL.md