skills.rest
antstanley
antstanleyCOMMUNITY
Explore all skills by this author →
GitHub

triage-finding

Triage existing security findings against a repository using static code evidence.

Updated May 4, 2026
Search Tags:#static analysis#github#vulnerability assessment#backlog#jira#sarif#security triage
One-click install
npx skills add https://github.com/antstanley/skills --skill triage-finding-antstanley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: triage-finding
Source: https://github.com/antstanley/skills/tree/main/plugins/security/skills/triage-finding
Command: npx skills add https://github.com/antstanley/skills --skill triage-finding-antstanley

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security teams accumulate noisy backlogs of findings from scanners, CVEs, advisories, bug bounty reports, and Jira/Linear tickets, and manually verifying whether each claim actually affects the current codebase is slow and inconsistent. ## Core Features & Use Cases - Static Evidence-Based Verdicts: Assigns one of three verdicts (confirmed, not_actionable, needs_review) per finding using source-to-sink tracing, reachability analysis, and SECURITY.md policy gates, without running any code. - Multi-Source Intake: Imports findings from GitHub code scanning, Dependabot alerts, security advisories, Jira, and Linear via REST or MCP connectors, normalizing them into a common triage record. - Exploitability Stack Ranking: Ranks confirmed and needs_review findings in separate priority queues and emits a machine-readable triage-finding/v0 JSON contract. - Use Case: A team imports 40 open Dependabot and code-scanning alerts from GitHub and receives a ranked, evidence-backed action queue showing which vulnerabilities are actually reachable in their shipped code. ## Quick Start Triage the open security findings from this GitHub repository and tell me which ones are confirmed exploitable in the current code.

Frequently Asked Questions about triage-finding

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage security findings from GitHub code scanning?▼

Supply the GitHub repository as owner/repo or a URL and choose code scanning as the source. The skill fetches open alerts via the GitHub REST API, normalizes them as SARIF-type findings, and statically verifies each against your local code.

How to triage Jira or Linear vulnerability tickets against my codebase?▼

Provide the Jira or Linear issue URLs, keys, or a search query. The skill retrieves ticket content through a configured MCP server, normalizes each issue as a scanner ticket, and assigns an evidence-backed verdict per finding.

Does this skill run exploits or dynamic validation to confirm vulnerabilities?▼

No, all triage is strictly static. It never runs tests, builds, applications, PoCs, or exploit checks; verdicts rely on source-to-sink tracing, reachability analysis, and repository security policy evidence.

What is the difference between confirmed and needs_review verdicts?▼

Confirmed requires static proof that the vulnerable condition is reachable and crosses a supported security boundary. Needs_review is used when provenance, control semantics, or boundary policy cannot be established statically, with the unresolved fact recorded as a proof gap.

Can this skill deduplicate or fix the findings it triages?▼

No, it keeps one result per supplied finding and never deduplicates. For confirmed findings it prepares a handoff prompt for the separate fix-finding skill, which runs only when the user explicitly asks.

Related Skills

Explore More Software Engineering Skills→
openaiopenai
5.3k

triage-finding

Triage existing security findings against a repository using static code evidence.

Official
Advanced
kiruna-labskiruna-labs
5

picky-security

Automate security audits with OWASP Top 10 and CWE mappings.

Official
Advanced
openaiopenai
5.3k

finding-discovery

Discovers plausible security vulnerability candidates in code changes and repositories.

Official
Advanced
salmanabdurrahmansalmanabdurrahman

mobile-android-dynamic

Intercept Android app traffic and inspect local storage during authorized security testing.

Community
Advanced