skills.rest
trailofbits
trailofbitsOFFICIAL
Explore all skills by this author →
Website𝕏@trailofbitsGitHub

vulnerability-triage-brocards

Evaluate vulnerability reports against 7 falsifiable brocards to accept, dismiss, or request more information.

6.9k|598|Updated Jan 14, 2026
Search Tags:#security review#bug bounty#threat model#vulnerability triage#cve assessment#false positive filtering#Security audit
One-click install
npx skills add https://github.com/trailofbits/skills --skill vulnerability-triage-brocards
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-triage-brocards
Source: https://github.com/trailofbits/skills/tree/main/plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards
Command: npx skills add https://github.com/trailofbits/skills --skill vulnerability-triage-brocards

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Security teams drown in raw findings from automated vulnerability discovery pipelines, CVE feeds, and bug bounty submissions, many of which are invalid or not actionable. This Skill provides a systematic, defensible method to filter those reports before committing auditor time, documenting exactly why each finding was accepted or dismissed.

Core Features & Use Cases

  • 7-Brocard Evaluation: Tests each report against threat model coherence, attacker capability vs. impact, real-world reachability, standard behavior, documented behavior, remediation cost, and report sufficiency.
  • Structured Verdicts: Produces PASS, DISMISS, or NEEDS-MORE-INFO verdicts per brocard with a summary table, overall verdict, and next step.
  • Rationalization Guards: Lists common reasoning failures in both directions to prevent wrongly dismissing valid findings or accepting invalid ones.
  • Use Case: An agentic vulnerability discovery pipeline produces 50 raw findings overnight. Run each through the 7 brocards to dismiss the majority with documented reasoning and escalate only the survivors to PoC development.

Quick Start

Triage this vulnerability report against the 7 brocards and tell me whether to accept, dismiss, or request more information.

Frequently Asked Questions about vulnerability-triage-brocards

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a vulnerability report before investing in analysis?▼

Evaluate the report against 7 brocards covering threat model, attacker capability, reachability, standard behavior, documented behavior, fix cost, and report sufficiency. Stop at the first DISMISS verdict or run all 7 for a full evaluation with a structured summary table.

How to filter false positives from automated vulnerability scanners?▼

Run each scanner finding through the brocard tests, especially reachability in actual usage and threat model coherence. Most automated findings fail one or more brocards and can be dismissed with documented reasoning before human review.

Should I trust a high CVSS score when prioritizing CVEs?▼

No. Brocard 7 states a CVE identifier or CVSS score neither proves nor disproves a vulnerability. Strip the metadata and judge the technical description alone, demanding concrete evidence of attacker capability and impact.

When should a vulnerability report be dismissed as documented behavior?▼

Dismiss when the project's documentation explicitly describes the behavior and warns against misuse, such as a tool marked not suitable for production. However, downstream projects violating documented guidelines may still have a valid vulnerability.

When not to use brocard-based vulnerability triage?▼

Do not use it for hunting new bugs during an audit, proving exploitability of a confirmed finding, or triaging fuzzer crashes in C/C++. Those tasks require dedicated discovery, PoC development, or crash triage skills instead.

Related Skills

Explore More Software Engineering Skills→
mindfortaimindfortai
16

finding-review

Triage cybersecurity findings for validity, exploitability, impact, and evidence quality.

Official
Advanced
freire19freire19

exploit-analysis

Develop proof-of-concept exploit plans from vulnerability findings and CVE research.

Community
Advanced
IntegralistIntegralist
2

security-review-feedback

Verify security review findings and assign verdicts based on reachability and exploitability.

Community
Advanced
jellaharshithjellaharshith
1

triage-validation

Validates security-finding reportability using a structured 7-question gate and four pre-submission checks.

Community
Advanced