skills.rest
air-gapped
air-gappedOFFICIAL
Explore all skills by this author →
GitHub

triage

Verify, deduplicate, rank, and route security findings into TRIAGE.json and TRIAGE.md.

5|1|Updated Apr 19, 2026
Search Tags:#workflow#security#deduplication#triage#ranking#findings#scanners
One-click install
npx skills add https://github.com/air-gapped/skills --skill triage-air-gapped
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: triage
Source: https://github.com/air-gapped/skills/tree/main/.claude/skills/triage
Command: npx skills add https://github.com/air-gapped/skills --skill triage-air-gapped

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Triage raw security findings by verifying, deduplicating, ranking, and routing them to component owners, producing concise TRIAGE.json and TRIAGE.md.

Core Features & Use Cases

  • Ingests vuln-scan outputs, crash reports, and loosely-structured JSON or Markdown from various scanners; converts them into a flat findings list with stable IDs and a consistent shape.
  • Produces TRIAGE.json and TRIAGE.md sorted by actionability, with a checkpoint-ready, resumable workflow across phases 0 through 6.
  • Supports interactive (default) or automated runs via --auto, with per-phase state persisted under .triage-state, and integration with the .claude/skills/triage/scripts/checkpoint.py tool.

Quick Start

From a Claude Code session, run /triage <findings-path> to ingest findings and generate TRIAGE.json and TRIAGE.md.

Frequently Asked Questions about triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I rank and deduplicate raw security scanner findings?▼

To triage raw security findings, ingest vuln-scan outputs, crash reports, or loosely-structured scanner results to verify, deduplicate, and rank them by actionability, generating a sorted TRIAGE.json and TRIAGE.md.

How do I route security vulnerabilities to component owners automatically?▼

You can route security vulnerabilities to component owners by running the triage workflow with the --auto flag, which processes findings without interactive prompts and outputs the routed assignments to TRIAGE.json and TRIAGE.md.

Can I triage unstructured JSON and Markdown scanner outputs in bulk?▼

Yes, you can triage loosely-structured JSON or Markdown scanner outputs by ingesting a file or directory of findings, which converts them into a flat findings list with stable IDs and a consistent shape.

Does the security findings triage workflow support resuming from checkpoints?▼

The security findings triage workflow supports resuming via checkpoint tools, persisting multi-phase state under .triage-state to allow resumable runs across phases 0 through 6 using checkpoint.py.

Do I need Claude Code CLI to rank and route raw security findings?▼

Yes, ranking and routing raw security findings requires the Claude Code CLI, as the workflow reads sources from the repo, runs scripts under .claude/skills/triage/scripts, and uses prompts from references/prompts.md.

Related Skills

Explore More Software Engineering Skills→
zekiriabdzekiriabd
140

sarif-parsing

Parse SARIF 2.1.0 files to extract, normalize, filter, and compare static analysis findings.

Community
Advanced
SocketDevSocketDev
125

triaging-findings

Verify, deduplicate, and rank scanner findings into TRIAGE.json and TRIAGE.md.

Official
Advanced
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate
maddhruvmaddhruv
207

absolute-audit

Scan codebases for security vulnerabilities in dependencies and code.

Community
Advanced