# Triage Vulnerability Report

> Triage a vulnerability report, scanner result, advisory, CVE, PoC, bug bounty, ticket, or researcher note. Use when affected versions, credibility, prerequisites, evidence, applicability, validation, and exposure must be established.

- Skill: `gaelic-ghost/triage-vulnerability-report` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gaelic-ghost/triage-vulnerability-report`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gaelic-ghost/triage-vulnerability-report/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- Author: gaelic-ghost (https://skillmd.com/u/gaelic-ghost)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gaelic-ghost/triage-vulnerability-report

---


# Triage Vulnerability Report

## Overview

Convert incoming claims into a testable hypothesis tied to an exact product, version, configuration, and asset. Do not reproduce active impact until authorization and the smallest safe validation plan are explicit.

Read [references/vulnerability-intake.md](references/vulnerability-intake.md) for the normalized record.

## Workflow

1. Preserve the original report and source.
2. Normalize identity.
   - Record product/component, versions, commit/build/image, dependency identity, advisory/CVE/CWE, endpoints/code paths, deployment/configuration, and affected assets.
3. Extract the claim.
   - State attacker position, prerequisites, input, security boundary crossed, result, impact, and supplied reproduction.
4. Grade evidence.
   - Separate scanner matching, vulnerable-code presence, reachability, successful reproduction, external advisory, and speculation.
   - Record logs, requests/responses, traces, screenshots, code, and environment details.
5. Check authoritative context.
   - Use vendor advisories, source/release history, OSV/ecosystem advisories, CISA KEV, and current disclosure state; date lookups.
6. Route ownership.
   - Use Codex Security for repository/diff scanning or attack-path work when available.
   - Route to vulnerability validation for a supplied claim and to the owning stack for remediation only after acceptance criteria are clear.
7. Define immediate action.
   - Identify exposed assets, reversible mitigations, missing evidence, safe validation, and disclosure/notification needs.

## Output

Return normalized identity, claim, evidence grade, asset applicability, duplicates/advisories, urgency, validation plan, and owner.