skills.rest
superagent-ai
superagent-aiOFFICIAL
Explore all skills by this author →
Website𝕏@superagent_aiGitHub

vulnerability-triage

Analyze vulnerability reports against project intent and produce a structured triage report.

76|11|Updated May 18, 2026
Search Tags:#security#vulnerability#CVE#triage#advisory#bug-bounty#GHSA
One-click install
npx skills add https://github.com/superagent-ai/skills --skill vulnerability-triage-superagent-ai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-triage
Source: https://github.com/superagent-ai/skills/tree/main/skills/vulnerability-triage
Command: npx skills add https://github.com/superagent-ai/skills --skill vulnerability-triage-superagent-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill acts as a first-line vulnerability analyst, reading inbound reports and deciding whether findings are real, by-design, or require more information, reducing noise and guiding remediation priorities.

Core Features & Use Cases

  • Ingests reports from GitHub Advisories, CVEs, bug bounty submissions, and issue exports, then cross-references project intent across SECURITY.md, README, and code.
  • Phase-driven workflow: Phase 1 ingest and parse; Phase 2 by-design shield; Phase 3 reproduce and score, culminating in a structured triage report.
  • Outputs a standalone triage document using the triage-report-template and provides redacted, shareable findings for security teams.

Quick Start

Paste the vulnerability report or advisory text to start the triage workflow.

Frequently Asked Questions about vulnerability-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage vulnerability reports from GitHub Advisories and CVEs?▼

To triage vulnerability reports, you ingest advisory text and cross-reference project intent from SECURITY.md, README, and closed issues. The process determines whether findings are real, by-design, or unverified, outputting a structured markdown triage report with redacted secrets.

What is the best way to determine if a bug bounty submission is a real vulnerability or by-design behavior?▼

Determining if a bug bounty submission is a real vulnerability or by-design behavior involves cross-referencing the claim against documented project intent. By analyzing SECURITY.md, code comments, and release notes, you can produce a standalone triage report classifying the finding.

How do I generate a structured security triage report from raw advisory text?▼

Generating a structured security triage report from raw advisory text requires a phase-driven workflow: ingest and parse, apply a by-design shield, then reproduce and score. This produces a standalone markdown document using a triage-report-template with redacted PII.

Can I use automated vulnerability triage for GitHub Security Advisories without exposing sensitive data?▼

Yes, you can triage GitHub Security Advisories while protecting sensitive data. The workflow produces redacted, shareable findings for security teams by automatically removing secrets and personally identifiable information from the final markdown triage report.

What sources do I need to cross-reference when verifying a CVE claim against my project?▼

When verifying a CVE claim, you need to cross-reference sources such as SECURITY.md, README, code comments, closed issues, pull requests, and release notes. This determines if the vulnerability finding is by-design, real, or unverified.

Related Skills

Explore More Software Engineering Skills→
mindfortaimindfortai
16

finding-review

Triage cybersecurity findings for validity, exploitability, impact, and evidence quality.

Official
Advanced
swannysecswannysec
2

security-vuln-analyzer

Orchestrates parallel security agents to validate vulnerabilities and generate remediation plans.

Community
Advanced
JuanTaco4YouJuanTaco4You

security-secrets-and-logging

Enforce redaction and safe logging to prevent credential and PII leakage.

Community
Basic
limit5limit5

SKILL_HD_CVE_IMPACT

Map CVE entries to affected components in a Software Bill of Materials.

Community
Intermediate