aikido-triage

Name: aikido-triage
Author: ShulkwiSEC

18stars5forks

How to install aikido-triage?

shulkwisec/bb-huge/aikido-triage

$npx -y skills add ShulkwiSEC/bb-huge --skill aikido-triage

Installs into the current project.

Summary

Triages an Aikido security findings CSV against a local codebase. For each finding, reads the flagged file, traces the code path, and verdicts it as KEEP OPEN or CLOSE with a specific reason. Outputs a reviewed CSV and a self-contained HTML evidence report. Run this at the end of

Files · 1

View on GitHub

SKILL.md

1	# Aikido Findings Triage Workflow
2
3	You are triaging an Aikido SAST/SCA/secret-scanning CSV export against a local codebase. Your job is to read every finding, investigate the flagged code, and verdict each one with evidence. At the end you produce a reviewed CSV and a self-contained HTML report.
4
5	Do not guess. Read the actual files before rendering a verdict.
6
7	---
8
9	## Arguments
10
11	Parse from the user's invocation:
12	- `CSV_PATH` — path to the Aikido CSV export
13	- `CODEBASE_PATH` — absolute path to the local codebase to investigate
14
15	If either argument is missing, ask the user before proceeding.
16
17	---
18
19	## Phase 1 — Parse the CSV
20
21	1. Read `CSV_PATH` with the Read tool.
22	2. Parse every row. Key columns to extract per finding:
23	- `aikido_issue_id` — unique ID
24	- `type` — `sast` \| `open_source` \| `leaked_secret` \| `eol`
25	- `severity` — critical / high / medium / low
26	- `affected_file` — relative path to the flagged file
27	- `related_cve` — CVE or advisory ID (may be empty)
28	- `rule` — rule name that fired
29	- `start_line` / `end_line` — flagged line range
30	- `installed_version` / `patched_version` — for SCA findings
31	- `affected_package` — for SCA/EOL findings
32
33	3. Group findings by `type` so you can batch-investigate efficiently.
34
35	---
36
37	## Phase 2 — Investigate Each Finding
38
39	Work through findings type by type. For each one, read the flagged file and apply the investigation playbook for that type.
40
41	### 2a — `leaked_secret` findings
42
43	Step 1 — Does the file exist?
44
45	Use the Read tool on `CODEBASE_PATH/affected_file`. If the file does not exist:
46	→ Verdict: CLOSE — File Removed
47	→ Note: "File does not exist at HEAD. Finding references removed code in git history."
48	→ Move on. Do not investigate further.
49
50	Step 2 — Read the flagged lines.
51
52	Read `start_line` to `end_line` (expand by ±3 lines for context).
53
54	Apply these patterns:
55
56	\| What you see \| Verdict \|
57	\|---\|---\|
58	\| `ENV.fetch(...)`, `ENV[...]`, `ENV.fetch(..., nil)` \| CLOSE — False Positive (env var read) \|
59	\| `${{ secrets.* }}` (GitHub Actions) \| CLOSE — False Positive (GH Actions secret) \|
60	\| `${VARIABLE_NAME}` in .npmrc/.env.example \| CLOSE — False Positive (env var placeholder) \|
61	\| `--mount=type=secret` in Dockerfile \| CLOSE — False Positive (Docker build secret) \|
62	\| A long regex, UA string, or binary-looking data \| CLOSE — False Positive (pattern mismatch) \|
63	\| An actual hardcoded token/key/password string \| KEEP OPEN — check liveness if possible \|
64	\| A real URL with embedded credentials (user:pass@host) \| KEEP OPEN \|
65
66	For `sidekiq-sensitive-url` rule: check whether the flagged content is a Redis URL with credentials or just a gem declaration. Almost always a false positive in Gemfile/Gemfile.lock.
67
68	Step 3 — If hardcoded secret found:
69	- Note the exact line and masked value
70	- Check if `secret_liveness` column says `active` — if so, escalate to critical
71	- Verdict: KEEP OPEN — Hardcoded Secret
72
73	---
74
75	### 2b — `sast` findings
76
77	Step 1 — Read the flagged file and lines.
78
79	Read `CODEBASE_PATH/affected_file` at `start_line` ± 10 lines of context.
80
81	Step 2 — Apply rule-specific investigation:
82
83	NoSQL injection (`NoSQL injection attack possible`)
84	- Trace what the flagged call actually does. Follow the call chain:
85	1. What does the flagged function call?
86	2. Does it call a NoSQL driver (MongoDB, Redis query, Elasticsearch, Mongoose)?
87	3. Or does it call an HTTP client (axios, fetch, HTTParty)?
88	- Check `CODEBASE_PATH/Gemfile` and `CODEBASE_PATH/package.json` for NoSQL drivers.
89	- If no NoSQL driver exists in the stack: CLOSE — False Positive
90
91	SQL injection (`SQL injection`, `string-based query concatenation`)
92	- Read the flagged method. Check:
93	1. Is there actual string interpolation into a raw SQL string? (`"... #{variable}"`)
94	2. What is the type of the interpolated variable? (Ruby `Date`, `Integer`, `String`?)
95	3. Is it executed via `select_all`, `execute`, or `connection.exec`?
96	4. Trace the variable back to its source — is it user-controlled?
97	- If raw interpolation exists but type coercion removes the injection vector: KEEP OPEN — Medium (dangerous pattern, mitigated)
98	- If raw interpolation with no type coercion on a user-controlled string: KEEP OPEN — High
99	- If interpolation is of a hardcoded or server-side-only value: CLOSE — False Positive
100
101	Unpinned GitHub Actions (`3rd party Github Actions should be pinned`)
102	- Read the workflow file at the flagged line.
103	- Check if `uses:` has a SHA pin (`@abc123def...`) or only a tag (`@v2`, `@main`).
104	- Tag-pi

People who liked this also viewed

6 picks

Type

aikido-triage

18stars5forks

View on GitHub

How to install aikido-triage?

shulkwisec/bb-huge/aikido-triage

$npx -y skills add ShulkwiSEC/bb-huge --skill aikido-triage

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Aikido Findings Triage Workflow
2
3	You are triaging an Aikido SAST/SCA/secret-scanning CSV export against a local codebase. Your job is to read every finding, investigate the flagged code, and verdict each one with evidence. At the end you produce a reviewed CSV and a self-contained HTML report.
4
5	Do not guess. Read the actual files before rendering a verdict.
6
7	---
8
9	## Arguments
10
11	Parse from the user's invocation:
12	- `CSV_PATH` — path to the Aikido CSV export
13	- `CODEBASE_PATH` — absolute path to the local codebase to investigate
14
15	If either argument is missing, ask the user before proceeding.
16
17	---
18
19	## Phase 1 — Parse the CSV
20
21	1. Read `CSV_PATH` with the Read tool.
22	2. Parse every row. Key columns to extract per finding:
23	- `aikido_issue_id` — unique ID
24	- `type` — `sast` \| `open_source` \| `leaked_secret` \| `eol`
25	- `severity` — critical / high / medium / low
26	- `affected_file` — relative path to the flagged file
27	- `related_cve` — CVE or advisory ID (may be empty)
28	- `rule` — rule name that fired
29	- `start_line` / `end_line` — flagged line range
30	- `installed_version` / `patched_version` — for SCA findings
31	- `affected_package` — for SCA/EOL findings
32
33	3. Group findings by `type` so you can batch-investigate efficiently.
34
35	---
36
37	## Phase 2 — Investigate Each Finding
38
39	Work through findings type by type. For each one, read the flagged file and apply the investigation playbook for that type.
40
41	### 2a — `leaked_secret` findings
42
43	Step 1 — Does the file exist?
44
45	Use the Read tool on `CODEBASE_PATH/affected_file`. If the file does not exist:
46	→ Verdict: CLOSE — File Removed
47	→ Note: "File does not exist at HEAD. Finding references removed code in git history."
48	→ Move on. Do not investigate further.
49
50	Step 2 — Read the flagged lines.
51
52	Read `start_line` to `end_line` (expand by ±3 lines for context).
53
54	Apply these patterns:
55
56	\| What you see \| Verdict \|
57	\|---\|---\|
58	\| `ENV.fetch(...)`, `ENV[...]`, `ENV.fetch(..., nil)` \| CLOSE — False Positive (env var read) \|
59	\| `${{ secrets.* }}` (GitHub Actions) \| CLOSE — False Positive (GH Actions secret) \|
60	\| `${VARIABLE_NAME}` in .npmrc/.env.example \| CLOSE — False Positive (env var placeholder) \|
61	\| `--mount=type=secret` in Dockerfile \| CLOSE — False Positive (Docker build secret) \|
62	\| A long regex, UA string, or binary-looking data \| CLOSE — False Positive (pattern mismatch) \|
63	\| An actual hardcoded token/key/password string \| KEEP OPEN — check liveness if possible \|
64	\| A real URL with embedded credentials (user:pass@host) \| KEEP OPEN \|
65
66	For `sidekiq-sensitive-url` rule: check whether the flagged content is a Redis URL with credentials or just a gem declaration. Almost always a false positive in Gemfile/Gemfile.lock.
67
68	Step 3 — If hardcoded secret found:
69	- Note the exact line and masked value
70	- Check if `secret_liveness` column says `active` — if so, escalate to critical
71	- Verdict: KEEP OPEN — Hardcoded Secret
72
73	---
74
75	### 2b — `sast` findings
76
77	Step 1 — Read the flagged file and lines.
78
79	Read `CODEBASE_PATH/affected_file` at `start_line` ± 10 lines of context.
80
81	Step 2 — Apply rule-specific investigation:
82
83	NoSQL injection (`NoSQL injection attack possible`)
84	- Trace what the flagged call actually does. Follow the call chain:
85	1. What does the flagged function call?
86	2. Does it call a NoSQL driver (MongoDB, Redis query, Elasticsearch, Mongoose)?
87	3. Or does it call an HTTP client (axios, fetch, HTTParty)?
88	- Check `CODEBASE_PATH/Gemfile` and `CODEBASE_PATH/package.json` for NoSQL drivers.
89	- If no NoSQL driver exists in the stack: CLOSE — False Positive
90
91	SQL injection (`SQL injection`, `string-based query concatenation`)
92	- Read the flagged method. Check:
93	1. Is there actual string interpolation into a raw SQL string? (`"... #{variable}"`)
94	2. What is the type of the interpolated variable? (Ruby `Date`, `Integer`, `String`?)
95	3. Is it executed via `select_all`, `execute`, or `connection.exec`?
96	4. Trace the variable back to its source — is it user-controlled?
97	- If raw interpolation exists but type coercion removes the injection vector: KEEP OPEN — Medium (dangerous pattern, mitigated)
98	- If raw interpolation with no type coercion on a user-controlled string: KEEP OPEN — High
99	- If interpolation is of a hardcoded or server-side-only value: CLOSE — False Positive
100
101	Unpinned GitHub Actions (`3rd party Github Actions should be pinned`)
102	- Read the workflow file at the flagged line.
103	- Check if `uses:` has a SHA pin (`@abc123def...`) or only a tag (`@v2`, `@main`).
104	- Tag-pi

People who liked this also viewed

6 picks

Type