/triage-vulnerability-report

name: triage-vulnerability-report
description: Triage a vulnerability report, scanner result, advisory, CVE, PoC, bug bounty, ticket, or researcher note. Use when affected versions, credibility, prerequisites, evidence, applicability, validation, and exposure must be established.

Triage Vulnerability Report

Overview

Convert incoming claims into a testable hypothesis tied to an exact product, version, configuration, and asset. Do not reproduce active impact until authorization and the smallest safe validation plan are explicit.

Read [references/vulnerability-intake.md](references/vulnerability-intake.md) for the normalized record.

Workflow

1. Preserve the original report and source. 2. Normalize identity.

• Record product/component, versions, commit/build/image, dependency identity, advisory/CVE/CWE, endpoints/code paths, deployment/configuration, and affected assets.

3. Extract the claim.

• State attacker position, prerequisites, input, security boundary crossed, result, impact, and supplied reproduction.

4. Grade evidence.

• Separate scanner matching, vulnerable-code presence, reachability, successful reproduction, external advisory, and speculation.
• Record logs, requests/responses, traces, screenshots, code, and environment details.

5. Check authoritative context.

• Use vendor advisories, source/release history, OSV/ecosystem advisories, CISA KEV, and current disclosure state; date lookups.

6. Route ownership.

• Use Codex Security for repository/diff scanning or attack-path work when available.
• Route to vulnerability validation for a supplied claim and to the owning stack for remediation only after acceptance criteria are clear.

7. Define immediate action.

• Identify exposed assets, reversible mitigations, missing evidence, safe validation, and disclosure/notification needs.

Output

Return normalized identity, claim, evidence grade, asset applicability, duplicates/advisories, urgency, validation plan, and owner.