security-disclosure-triage

What problem does it solve?

Verify whether an incoming security advisory is a real, disclosable vulnerability in a target repository checkout, and assign an honest severity. Use when triaging an advisory, GHSA, scanner finding, or draft report from the researcher/reporter side to decide if it is worth disclosing. Optimizes against false confirmations and inflated severity.

Core Features & Use Cases

• Reproduces the advisory construct to determine if it maps to a real vulnerability.
• Identifies the crown-jewel asset and the actual guard, reducing false positives.
• Produces structured triage outputs and a recommended disposition with severity calculations.
• Use Case: A security team receives a GHSA draft, and this skill guides evaluation from reproduction to disclosure decision.

Quick Start

Follow the triage framework to assess a new advisory against a target repository checkout and produce a triage report.