vulnerability-triage-brocards agent skill by trailofbits
This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.
Source and license
| Publisher | trailofbits |
|---|---|
| Repository | trailofbits/skills |
| License | CC-BY-SA-4.0 |
| Snapshot | 2026-10-22 |
| Last repository commit | 2026-10-15 |
| Instruction size | 1,189 words; 194 lines |
| Bundled files | 2 |
Suede Skill Check: 90/100 · A
Report snapshot · · graded-v2
The rubric totals 100 points; published scores are capped at 99. Security scan: not scanned.
Source revision: 5c99c03fb8a9. Report version 0a8ebd20a768. Badge URLs follow the latest listing; save the report to keep this version.
Download report · Request a fresh review
What to review next
- Boundary clause: 0 of 4 points. 4 when the description says when not to use the skill (“Not for …”, “Do not use …”, “Use … instead”).
- Bundled scripts: 0 of 2 points. 2 when the skill folder ships a scripts/ folder.
- Tool permissions declared: 0 of 2 points. 2 when the frontmatter declares allowed-tools.
Add declarations and bundled files when they describe the skill’s actual needs. Update the source, then request a fresh review with the changed commit or PR.
| Component | Points earned | Available |
|---|---|---|
| Structural checks | 56 | 56 |
| Description length | 5 | 5 |
| Boundary clause | 0 | 4 |
| Example request | 3 | 3 |
| Instruction depth | 7 | 7 |
| Reference files | 3 | 3 |
| Bundled scripts | 0 | 2 |
| Recent maintenance | 9 | 9 |
| Curated-list citations | 7 | 7 |
| Tool permissions declared | 0 | 2 |
| Compatibility declared | 0 | 2 |
The published score is capped at 99. It measures the published files, documentation and maintenance signals. Security scan: not scanned. This assessment does not include a runtime test or a full installation-dependency review.
Install vulnerability-triage-brocards
The skills CLI works with Claude Code, Codex, Cursor and other agents; the other routes copy the folder by hand.
npx skills add https://github.com/trailofbits/skills/tree/main/plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocardstmp="$(mktemp -d)"
git clone --depth 1 https://github.com/trailofbits/skills.git "$tmp/repo"
mkdir -p .claude/skills
cp -R "$tmp/repo/"plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards .claude/skills/
rm -rf "$tmp"tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/trailofbits/skills.git "$tmp/repo"
mkdir -p .agents/skills
cp -R "$tmp/repo/"plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards .agents/skills/
rm -rf "$tmp"For a user-level install, copy the folder to ~/.claude/skills/ (Claude Code) or ~/.agents/skills/ (Codex). Inside Codex, $skill-installer can also fetch a skill from GitHub. New to skills? Read How to install agent skills in Claude Code, Codex and Cursor.
trailofbits/skills is third-party code. Read SKILL.md and any bundled scripts before you install it.
Two badges for vulnerability-triage-brocards
Choose the numeric badge, the letter badge, or both. Each links to this skill’s Suede AI listing; either valid linked badge can qualify for the feature offer.
[](https://suedeai.directory/trailofbits/skills/vulnerability-triage-brocards/)
[](https://suedeai.directory/trailofbits/skills/vulnerability-triage-brocards/)<a href="https://suedeai.directory/trailofbits/skills/vulnerability-triage-brocards/"><img src="https://suedeai.directory/trailofbits/skills/vulnerability-triage-brocards/score.svg" alt="Suede Skill Check: 90/100" width="160" height="175"></a>
<a href="https://suedeai.directory/trailofbits/skills/vulnerability-triage-brocards/"><img src="https://suedeai.directory/trailofbits/skills/vulnerability-triage-brocards/badge.svg" alt="Suede Skill Check: Grade A" width="160" height="175"></a>Suede Certified on the shield refers to this published structural quality check. Security scan: not scanned. Read the methodology.
Limited-time feature offer: Display either quality badge in your repository or skill README, linked to your listing, then request verification. Suede AI checks the rendered README at a recorded commit. Eligible skills scoring 80–99 with a verified badge can receive a featured placement while the offer is open. Request badge verification.
Publishers: read How to get your agent skill found in search and cited by AI assistants.