# vulnerability-triage-brocards

This skill assesses vulnerability reports against seven criteria, helping an agent reject weak findings, ask for evidence, or escalate a report.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1400 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/vulnerability-triage-brocards

## What it does

Use the skill to assess incoming vulnerability reports, CVEs, and results from automated discovery. It checks the attacker’s threat model and required capabilities, whether the affected code path is reached in practice, how the behavior relates to standards and documentation, the impact of a proposed fix, and the technical evidence. Each check receives a PASS, DISMISS, or NEEDS-MORE-INFO verdict.

By default, the review stops at the first DISMISS. If asked for a full assessment, the agent continues through all seven checks and produces a structured summary with reasons. Reports that pass can move on to PoC development and a formal writeup.

This is a triage skill, not a bug-hunting or exploitability-proof tool. The description points to a dedicated crash-triage skill for fuzzer crashes in C/C++.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill vulnerability-triage-brocards -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/vulnerability-triage-brocards/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/vulnerability-triage-brocards/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill vulnerability-triage-brocards -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/vulnerability-triage-brocards/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill vulnerability-triage-brocards -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/vulnerability-triage-brocards/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills vulnerability-triage-brocards
```

2. **Manually: put the files in place**
- File: `.github/skills/vulnerability-triage-brocards/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill vulnerability-triage-brocards -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/vulnerability-triage-brocards/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill vulnerability-triage-brocards -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards/SKILL.md

## When to use it
- screen automated vulnerability findings before human review
- check whether an attack scenario can reach the affected code
- assess whether a CVE affects a codebase under review
- request evidence needed to judge a submitted report
- document why a finding should be dismissed or deprioritized

## Example prompts
- Assess this vulnerability report against all seven checks and explain each verdict.
- Check whether this CVE affects our codebase, and list the evidence needed to decide.
- Review this automated finding and stop at the first reason to dismiss it.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md