vulnerability-triage-brocards
This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.
npx skills add trailofbits/skills --skill vulnerability-triage-brocards --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Vulnerability Triage Brocards Systematically evaluate incoming vulnerability reports against 7 principled criteria before committing resources to deeper analysis. Each brocard is a falsifiable test: if a report fails any brocard, document the reason and dismiss or request clarification. If a report survives all 7, escalate it. The 7 brocards are adapted from William Woodruff's ["Brocards for vulnerability triage"](https://blog.yossarian.net/2026/04/11/Brocards-for-vulnerability-triage) (2026). ## When to Use - Filtering findings from agentic vulnerability discovery pipelines before human review -- the primary use case; most automated runs produce findings that fail one or more brocards and can be dismissed without auditor time - Triaging findings during a ToB audit to decide which warrant escalation to PoC development - Evaluating third-party CVEs or advisories against a codebase under active audit to decide if they affect engagement scope - Reviewing bug bounty submissions or external vulnerability reports for ToB open-source projects - Providing structured, defensible justification when recommending a client dismiss or deprioritize a reported CVE ## When NOT to Use - **Hunting
- When to Use
- When NOT to Use
- Pipeline Position
- Triage Workflow
- Brocard 1: No Vulnerability Without a Threat Model
- Brocard 2: No Exploit from the Heavens
- Brocard 3: No Vulnerability Outside of Usage
- Brocard 4: No Vulnerability from Standard Behavior
- Brocard 5: No Vulnerability from Documented Behavior
- Brocard 6: No Cure Worse Than the Disease
- Brocard 7: The Report Is Neither Necessary nor Sufficient
- Output Format
- Rationalizations to Reject
- Wrongly Dismissing Valid Findings
What does the vulnerability-triage-brocards skill do?
This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.
How do I install it?
Run `npx skills add trailofbits/skills --skill vulnerability-triage-brocards --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.