triage

Name: triage
Author: anthropics

6.7kstars543forks

How to install triage?

anthropics/defending-code-reference-harness/triage

$npx -y skills add anthropics/defending-code-reference-harness --skill triage

Installs into the current project.

Summary

Triage a batch of raw security findings. Verify each is real,

Files · 1

View on GitHub

SKILL.md

1	# triage
2
3	Adversarial triage of raw security-scanner output. Does four jobs:
4	verify each finding is real, deduplicate across runs and scanners,
5	rank survivors by derived exploitability rather than the scanner's
6	claimed severity, and route each to a component owner. Output is a
7	short, ranked, owned list instead of a raw dump.
8
9	Invoke with `/triage <findings-path> [--auto] [--votes N] [--repo PATH] [--fp-rules FILE]`.
10
11	Arguments (parse from `$ARGUMENTS`; positional `$1`/`$2` expansion is
12	not stable across runtimes):
13	- findings path (first positional, required): a JSON file, a directory of
14	JSON files, a `VULN-FINDINGS.json`, an `INCIDENTS.json`, a pipeline
15	`results/<target>/<ts>/` directory, or a markdown report.
16	- `--auto`: skip the interview and use defaults. Default mode is
17	interactive.
18	- `--votes N`: verifier votes per finding (default 3; use 1 for a quick
19	pass, 5 for high-stakes batches).
20	- `--repo PATH`: path to the target codebase, read-only (default cwd).
21	Verification needs source access; the skill stops with an error if the
22	cited files aren't reachable.
23	- `--fp-rules FILE`: append the contents of FILE to the verifier's
24	exclusion-rule list (Phase 3a). Use for org-specific precedents: "we use
25	Prisma ORM everywhere — raw-query SQLi only", "k8s resource limits cover
26	DoS", etc. Plain text, one rule per line or paragraph.
27	- `--fresh`: ignore any existing checkpoint in `./.triage-state/` and start
28	from Phase 0. Without this flag the skill resumes from the last completed
29	phase if a checkpoint is present.
30
31	Tools: Read, Glob, Grep, Write, Task, AskUserQuestion. Bash is
32	permitted only for `git`, `find`, `wc`, `ls`, `jq`, and
33	`python3 .claude/skills/_lib/checkpoint.py` (checkpoint I/O).
34
35	Do not execute target code. No building, running, installing
36	dependencies, or sending requests. A proof-of-concept that accidentally
37	works against something real is unacceptable, and "couldn't write a working
38	PoC" is weak evidence of non-exploitability. Every conclusion comes from
39	reading source. This applies to the orchestrator and every subagent;
40	include the constraint in every Task prompt. For high-confidence HIGH
41	findings, recommend a human-built PoC as a follow-up instead.
42
43	Do not reach the network. No package-registry lookups, CVE-database
44	queries, or upstream-commit fetches.
45
46	---
47
48	## Checkpointing (runs before Phase 0 and after every phase)
49
50	On large finding batches a full run can exhaust context or hit rate limits
51	mid-way — particularly Phase 3, which spawns `candidates × votes` verifiers.
52	Phase state persists to `./.triage-state/` so a fresh `/triage` session can
53	resume without re-asking the interview or re-spawning verifiers.
54
55	All checkpoint I/O goes through `python3 .claude/skills/_lib/checkpoint.py`
56	(atomic writes, JSON-validated). Never use the Write tool for `progress.json`
57	directly. Never pass payload via heredoc or stdin; target-derived strings
58	could collide with the heredoc delimiter and break out to shell. The
59	Write→`--from` pattern keeps repo-derived bytes out of Bash argv.
60
61	State files in `./.triage-state/`:
62	- `progress.json` — single source of truth for resume position:
63	`{"status": "running"\|"complete", "phase_done": N, "shards_done": [...]}`.
64	Resume decisions read ONLY this file, never a glob of `phase*.json` or
65	shard files (stale files from a prior run must not be trusted).
66	- `phaseN.json` — data payload for phase N (schemas at the tail of each phase
67	section below).
68	- `_chunk.tmp` — transient payload buffer; overwritten before every
69	`save`/`shard`/`append` call.
70
71	Start of run — resume check. Bash:
72	`python3 .claude/skills/_lib/checkpoint.py load ./.triage-state`
73
74	- `status == "absent"` OR `"complete"`, OR `--fresh` in `$ARGUMENTS` →
75	fresh start. Bash:
76	`python3 .claude/skills/_lib/checkpoint.py reset ./.triage-state`,
77	then proceed to Phase 0.
78	- `status == "running"` with `phase_done == N` → resume. Read
79	`./.triage-state/phase0.json` through `phaseN.json` in order (and any
80	`shard_*.json` files listed in `shards_done`), merging keys into working
81	state (later files override earlier — checkpoints may be deltas). Print
82	`R

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

triage

6.7kstars543forks

View on GitHub

How to install triage?

anthropics/defending-code-reference-harness/triage

$npx -y skills add anthropics/defending-code-reference-harness --skill triage

Installs into the current project.

Summary

Triage a batch of raw security findings. Verify each is real,

Files · 1

View on GitHub

SKILL.md

1	# triage
2
3	Adversarial triage of raw security-scanner output. Does four jobs:
4	verify each finding is real, deduplicate across runs and scanners,
5	rank survivors by derived exploitability rather than the scanner's
6	claimed severity, and route each to a component owner. Output is a
7	short, ranked, owned list instead of a raw dump.
8
9	Invoke with `/triage <findings-path> [--auto] [--votes N] [--repo PATH] [--fp-rules FILE]`.
10
11	Arguments (parse from `$ARGUMENTS`; positional `$1`/`$2` expansion is
12	not stable across runtimes):
13	- findings path (first positional, required): a JSON file, a directory of
14	JSON files, a `VULN-FINDINGS.json`, an `INCIDENTS.json`, a pipeline
15	`results/<target>/<ts>/` directory, or a markdown report.
16	- `--auto`: skip the interview and use defaults. Default mode is
17	interactive.
18	- `--votes N`: verifier votes per finding (default 3; use 1 for a quick
19	pass, 5 for high-stakes batches).
20	- `--repo PATH`: path to the target codebase, read-only (default cwd).
21	Verification needs source access; the skill stops with an error if the
22	cited files aren't reachable.
23	- `--fp-rules FILE`: append the contents of FILE to the verifier's
24	exclusion-rule list (Phase 3a). Use for org-specific precedents: "we use
25	Prisma ORM everywhere — raw-query SQLi only", "k8s resource limits cover
26	DoS", etc. Plain text, one rule per line or paragraph.
27	- `--fresh`: ignore any existing checkpoint in `./.triage-state/` and start
28	from Phase 0. Without this flag the skill resumes from the last completed
29	phase if a checkpoint is present.
30
31	Tools: Read, Glob, Grep, Write, Task, AskUserQuestion. Bash is
32	permitted only for `git`, `find`, `wc`, `ls`, `jq`, and
33	`python3 .claude/skills/_lib/checkpoint.py` (checkpoint I/O).
34
35	Do not execute target code. No building, running, installing
36	dependencies, or sending requests. A proof-of-concept that accidentally
37	works against something real is unacceptable, and "couldn't write a working
38	PoC" is weak evidence of non-exploitability. Every conclusion comes from
39	reading source. This applies to the orchestrator and every subagent;
40	include the constraint in every Task prompt. For high-confidence HIGH
41	findings, recommend a human-built PoC as a follow-up instead.
42
43	Do not reach the network. No package-registry lookups, CVE-database
44	queries, or upstream-commit fetches.
45
46	---
47
48	## Checkpointing (runs before Phase 0 and after every phase)
49
50	On large finding batches a full run can exhaust context or hit rate limits
51	mid-way — particularly Phase 3, which spawns `candidates × votes` verifiers.
52	Phase state persists to `./.triage-state/` so a fresh `/triage` session can
53	resume without re-asking the interview or re-spawning verifiers.
54
55	All checkpoint I/O goes through `python3 .claude/skills/_lib/checkpoint.py`
56	(atomic writes, JSON-validated). Never use the Write tool for `progress.json`
57	directly. Never pass payload via heredoc or stdin; target-derived strings
58	could collide with the heredoc delimiter and break out to shell. The
59	Write→`--from` pattern keeps repo-derived bytes out of Bash argv.
60
61	State files in `./.triage-state/`:
62	- `progress.json` — single source of truth for resume position:
63	`{"status": "running"\|"complete", "phase_done": N, "shards_done": [...]}`.
64	Resume decisions read ONLY this file, never a glob of `phase*.json` or
65	shard files (stale files from a prior run must not be trusted).
66	- `phaseN.json` — data payload for phase N (schemas at the tail of each phase
67	section below).
68	- `_chunk.tmp` — transient payload buffer; overwritten before every
69	`save`/`shard`/`append` call.
70
71	Start of run — resume check. Bash:
72	`python3 .claude/skills/_lib/checkpoint.py load ./.triage-state`
73
74	- `status == "absent"` OR `"complete"`, OR `--fresh` in `$ARGUMENTS` →
75	fresh start. Bash:
76	`python3 .claude/skills/_lib/checkpoint.py reset ./.triage-state`,
77	then proceed to Phase 0.
78	- `status == "running"` with `phase_done == N` → resume. Read
79	`./.triage-state/phase0.json` through `phaseN.json` in order (and any
80	`shard_*.json` files listed in `shards_done`), merging keys into working
81	state (later files override earlier — checkpoints may be deltas). Print
82	`R

People who liked this also viewed

6 picks

Type