domains / families / security / vulnerability-triage-brocards

vulnerability-triage-brocards

separate

This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.

When to use

• Filtering findings from agentic vulnerability discovery pipelines
• Triaging findings during a ToB audit to decide which warrant
• Evaluating third-party CVEs or advisories against a codebase under
• Reviewing bug bounty submissions or external vulnerability reports
• Providing structured, defensible justification when recommending a

When not to use

• **Hunting for new bugs during an audit** -- use other skills
• **Proving exploitability of a confirmed finding** -- use a
• **Triaging fuzzer crashes in C/C++** -- use a dedicated crash

Skill page

Source