vulnerability-triage-brocards
An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, compliance, security, triage.
What it does
This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill vulnerability-triage-brocardsOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards ~/.claude/skills/vulnerability-triage-brocardsSafety box score
Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is documentation-only: it teaches an agent how to triage vulnerability reports using seven brocards. It does not include executable code, file operations, network access, or credential handling; the main effect is policy guidance that can influence whether reports are dismissed or escalated.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No scripts, shell commands, or code evaluation are shipped; the inventory is just two markdown files. |
| Network access | 0 (none) | The files mention an external reference link, but they do not instruct the agent to fetch or send anything over the network. |
| Filesystem reach | 0 (none) | There are no read/write/delete instructions for local paths beyond reading the bundled markdown docs. |
| Secrets & credentials | 0 (none) | The skill does not ask for tokens, keys, passwords, or other secrets. |
| Privilege & persistence | 0 (none) | No sudo, service installation, shell startup edits, or other privilege-changing actions are present. |
| Instruction hijack surface | 0 (none) | The content is triage guidance only; it does not tell the agent to ignore rules, hide information, or follow fetched instructions. |
| Irreversible actions | 0 (none) | It does not send messages, deploy, pay, post, or delete; it only recommends accept/dismiss/request-more-info outcomes. |
| Transparency | 0 (none) | All shipped content is plain text markdown; there are no binaries, blobs, or decoded-at-runtime artifacts. |
Before installing
- Read `SKILL.md` and `references/brocards-detail.md` to confirm the brocards match your triage policy.
- Confirm you want a triage-only skill; it is designed to dismiss or escalate reports, not to prove exploits or hunt new bugs.
Rated 2026-10-20 by an automated review of 2 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards/SKILL.md
- Branch
- main
- Collection
- vulnerability-triage-brocards
- Updated
- 2026-09-19
Related skills
- supply-chain-risk-auditor — Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree.
- trailmark-finding-triage — Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function.
- algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
- audit-augmentation — Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files.
- audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
- audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.