skeptical-triage

Validate security findings through multi-round self-challenge and arbiter verification.

75|13|Updated Apr 5, 2026

Search Tags:#code review #security audit #triage #arbiter #false positive mitigation

Ready to run

npx skills add https://github.com/avelikiy/great_cto --skill skeptical-triage

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skeptical-triage
Source: https://github.com/avelikiy/great_cto/tree/main/skills/skeptical-triage
Command: npx skills add https://github.com/avelikiy/great_cto --skill skeptical-triage

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps mitigate false positives in code reviews and security audits by applying a three-round self-challenge and arbiter process, reducing CTO time waste and improving overall confidence in findings.

Core Features & Use Cases

3-Round Skeptical Triage: Conducts an in-depth analysis of findings, addressing reachability, defenses, and missed angles before an arbiter's final decision.
Arbiter Pattern: Ensures a final, impartial verdict, particularly useful in resolving conflicting signals or critical decisions.
Use Case: When a security review flags a potential vulnerability that could block a gate, this Skill can be used to validate or invalidate the finding, saving time and resources.

Quick Start

Use the skeptical-triage skill to validate a finding in the codebase.

Frequently Asked Questions about skeptical-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reduce false positives in security audits and code reviews?▼

False positives in security audits are reduced by applying a three-round skeptical triage process that challenges findings on reachability and defenses before an arbiter issues a final impartial verdict.

What is the arbiter pattern for triaging security findings?▼

The arbiter pattern for triaging security findings provides a final, impartial verdict after a multi-round self-challenge, resolving conflicting signals to validate or invalidate potential vulnerabilities before they block a release gate.

How do I validate a flagged vulnerability before blocking a deployment gate?▼

Validate a flagged vulnerability before blocking a deployment gate by conducting an in-depth skeptical triage that checks reachability, missed angles, and existing defenses, yielding a confidence-backed decision to proceed or block.

Can I use skeptical triage for QA regression checks alongside security audits?▼

Skeptical triage applies to QA regression checks alongside security audits by using a multi-step self-challenge and arbiter verification to confirm whether flagged issues are genuine defects or false alarms.

Do I need specific tools to run multi-round self-challenge code reviews?▼

Multi-round self-challenge code reviews require standard analysis tools like Read, Grep, Bash, and Glob to inspect the codebase and verify the reachability and context of flagged findings.

What are the limitations of using an arbiter pattern for security finding validation?▼

The arbiter pattern for security finding validation requires multiple analysis rounds, meaning it is designed for in-depth verification of critical blocking issues rather than rapid high-volume scanning of every minor code review flag.