Skip to main content
affpapa.org
RU EN
skill CX Codex

vulnerability-triage-brocards — Claude Code skill for vulnerability

This skill assesses vulnerability reports against seven criteria, helping an agent reject weak findings, ask for evidence, or escalate a report.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill vulnerability-triage-brocards -a claude-code
Open on GitHub

What vulnerability-triage-brocards does

Use the skill to assess incoming vulnerability reports, CVEs, and results from automated discovery. It checks the attacker’s threat model and required capabilities, whether the affected code path is reached in practice, how the behavior relates to standards and documentation, the impact of a proposed fix, and the technical evidence. Each check receives a PASS, DISMISS, or NEEDS-MORE-INFO verdict.

By default, the review stops at the first DISMISS. If asked for a full assessment, the agent continues through all seven checks and produces a structured summary with reasons. Reports that pass can move on to PoC development and a formal writeup.

This is a triage skill, not a bug-hunting or exploitability-proof tool. The description points to a dedicated crash-triage skill for fuzzer crashes in C/C++.

What it helps with

  • screen automated vulnerability findings before human review
  • check whether an attack scenario can reach the affected code
  • assess whether a CVE affects a codebase under review
  • request evidence needed to judge a submitted report
  • document why a finding should be dismissed or deprioritized

Example prompts for the agent

  • Assess this vulnerability report against all seven checks and explain each verdict.
  • Check whether this CVE affects our codebase, and list the evidence needed to decide.
  • Review this automated finding and stop at the first reason to dismiss it.

How to install vulnerability-triage-brocards

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill vulnerability-triage-brocards -a claude-code

2Manually: put the files in place

~/.claude/skills/vulnerability-triage-brocards/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/vulnerability-triage-brocards/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about vulnerability-triage-brocards

How do I install vulnerability-triage-brocards in Claude Code?

Run npx skills add trailofbits/skills --skill vulnerability-triage-brocards -a claude-code. The skill file is at ~/.claude/skills/vulnerability-triage-brocards/SKILL.md.

What does vulnerability-triage-brocards do?

It assesses vulnerability reports and CVEs using seven checks, then helps the agent accept a finding, dismiss it, or ask for more evidence.

Can this skill find new bugs?

No. It evaluates reported or discovered findings; the description directs users to other skills for bug hunting.

Similar skills

Everything for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set77

genotoxic Sorts survived mutants into false positives, missing unit tests and fuzzing targets, using a code graph built with Trailmark. CX Codex +1 3,800installs c-review Reviews native C/C++ code for memory bugs, integer overflows and races. Use it when auditing userspace applications, daemons or services. CX Codex +1 3,700installs chrome-mcp-troubleshooting Troubleshoots native host clashes between Claude Code and Chrome on macOS. Fixes broken bridge connections when browser tools refuse to run. CX Codex +1 2,400installs rust-review Audits Rust crates and libraries for memory safety in unsafe blocks, FFI boundaries, concurrency bugs, and panic DoS. Useful for in-depth security reviews. CX Codex +1 2,000installs trailmark-review-gate The skill runs structural security gates on branches or pull requests using Trailmark graph diffs. It flags removed auth checks, newly reachable sinks, and expanded attack surfaces. CX Codex +1 1,300installs trailmark-variant-neighborhood This skill expands a suspected vulnerability into related code locations for review. Use it before variant analysis, Semgrep, static analysis, or a manual audit. CX Codex +1 1,300installs trailmark-finding-triage Builds a graph evidence packet for a single security finding: reachability, entrypoint paths, taint and blast radius. Useful before you spend time on a PoC. CX Codex +1 1,300installs slicing-code-context Extracts bounded, graph-informed source code slices via Trailmark and delegates analysis to a smaller subagent. Useful when running focused tasks on local or constrained models. CX Codex +1 1,300installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor