vulnerability-triage-brocards
An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, compliance, security, triage.
What it does
This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill vulnerability-triage-brocardsOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards ~/.claude/skills/vulnerability-triage-brocardsSafety box score
Not rated yet. A safety box score grades what a skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. Anyone can request one from this page; it is saved for everyone. How the score works.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards/SKILL.md
- Branch
- main
- Collection
- vulnerability-triage-brocards
- Updated
- 2026-09-19
Related skills
- supply-chain-risk-auditor — Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree.
- trailmark-finding-triage — Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function.
- algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
- audit-augmentation — x binary-analysis graph exports. ).
- audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
- audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.