vulnerability-triage

Name: vulnerability-triage
Availability: InStock
Author: Superagent

Analyze vulnerability reports against project intent and produce a structured triage report.

76|11|Updated May 18, 2026

Search Tags:#security #vulnerability #CVE #triage #advisory #bug-bounty #GHSA

Ready to run

npx skills add https://github.com/superagent-ai/skills --skill vulnerability-triage-superagent-ai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: vulnerability-triage
Source: https://github.com/superagent-ai/skills/tree/main/skills/vulnerability-triage
Command: npx skills add https://github.com/superagent-ai/skills --skill vulnerability-triage-superagent-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill acts as a first-line vulnerability analyst, reading inbound reports and deciding whether findings are real, by-design, or require more information, reducing noise and guiding remediation priorities.

Core Features & Use Cases

Ingests reports from GitHub Advisories, CVEs, bug bounty submissions, and issue exports, then cross-references project intent across SECURITY.md, README, and code.
Phase-driven workflow: Phase 1 ingest and parse; Phase 2 by-design shield; Phase 3 reproduce and score, culminating in a structured triage report.
Outputs a standalone triage document using the triage-report-template and provides redacted, shareable findings for security teams.

Quick Start

Paste the vulnerability report or advisory text to start the triage workflow.

Frequently Asked Questions about vulnerability-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I triage vulnerability reports from GitHub Advisories and CVEs?▼

To triage vulnerability reports, you ingest advisory text and cross-reference project intent from SECURITY.md, README, and closed issues. The process determines whether findings are real, by-design, or unverified, outputting a structured markdown triage report with redacted secrets.

What is the best way to determine if a bug bounty submission is a real vulnerability or by-design behavior?▼

Determining if a bug bounty submission is a real vulnerability or by-design behavior involves cross-referencing the claim against documented project intent. By analyzing SECURITY.md, code comments, and release notes, you can produce a standalone triage report classifying the finding.

How do I generate a structured security triage report from raw advisory text?▼

Generating a structured security triage report from raw advisory text requires a phase-driven workflow: ingest and parse, apply a by-design shield, then reproduce and score. This produces a standalone markdown document using a triage-report-template with redacted PII.

Can I use automated vulnerability triage for GitHub Security Advisories without exposing sensitive data?▼

Yes, you can triage GitHub Security Advisories while protecting sensitive data. The workflow produces redacted, shareable findings for security teams by automatically removing secrets and personally identifiable information from the final markdown triage report.

What sources do I need to cross-reference when verifying a CVE claim against my project?▼

When verifying a CVE claim, you need to cross-reference sources such as SECURITY.md, README, code comments, closed issues, pull requests, and release notes. This determines if the vulnerability finding is by-design, real, or unverified.