[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-vulnerability-triage-brocards":3,"mdc--ijnht1-key":41,"related-org-trail-of-bits-vulnerability-triage-brocards":606,"related-repo-trail-of-bits-vulnerability-triage-brocards":760},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":36,"sourceUrl":39,"mdContent":40},"vulnerability-triage-brocards","triage and assess security vulnerability reports","This skill should be used when the user asks to \"triage a vulnerability report\", \"assess a CVE\", \"evaluate a bug bounty submission\", \"decide if a finding is valid\", \"review a security finding\", \"dismiss a vulnerability\", \"should we fix this CVE\", \"prioritize a vulnerability report\", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20,23,26],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Audit","audit",{"name":21,"slug":22,"type":16},"Triage","triage",{"name":24,"slug":25,"type":16},"Code Analysis","code-analysis",{"name":27,"slug":28,"type":16},"Risk Assessment","risk-assessment",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-08-01T06:06:34.719192",null,541,[35],"agent-skills",{"repoUrl":30,"stars":29,"forks":33,"topics":37,"description":38},[35],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Fvulnerability-triage-brocards\u002Fskills\u002Fvulnerability-triage-brocards","---\nname: vulnerability-triage-brocards\ndescription: >-\n  This skill should be used when the user asks to \"triage a vulnerability\n  report\", \"assess a CVE\", \"evaluate a bug bounty submission\", \"decide if a\n  finding is valid\", \"review a security finding\", \"dismiss a vulnerability\",\n  \"should we fix this CVE\", \"prioritize a vulnerability report\", or needs\n  to determine whether an incoming vulnerability report warrants\n  investigation. Applies 7 brocards (rules of thumb) to systematically\n  accept, dismiss, or request more information on vulnerability reports,\n  or needs to filter raw findings from agentic vulnerability\n  discovery pipelines before human review.\n---\n\n# Vulnerability Triage Brocards\n\nSystematically evaluate incoming vulnerability reports against 7 principled\ncriteria before committing resources to deeper analysis. Each brocard is a\nfalsifiable test: if a report fails any brocard, document the reason and\ndismiss or request clarification. If a report survives all 7, escalate it.\n\nThe 7 brocards are adapted from William Woodruff's\n[\"Brocards for vulnerability triage\"](https:\u002F\u002Fblog.yossarian.net\u002F2026\u002F04\u002F11\u002FBrocards-for-vulnerability-triage)\n(2026).\n\n## When to Use\n\n- Filtering findings from agentic vulnerability discovery pipelines\n  before human review -- the primary use case; most automated runs\n  produce findings that fail one or more brocards and can be dismissed\n  without auditor time\n- Triaging findings during a ToB audit to decide which warrant\n  escalation to PoC development\n- Evaluating third-party CVEs or advisories against a codebase under\n  active audit to decide if they affect engagement scope\n- Reviewing bug bounty submissions or external vulnerability reports\n  for ToB open-source projects\n- Providing structured, defensible justification when recommending a\n  client dismiss or deprioritize a reported CVE\n\n## When NOT to Use\n\n- **Hunting for new bugs during an audit** -- use other skills\n- **Proving exploitability of a confirmed finding** -- use a\n  dedicated PoC\u002Fexploitability skill\n- **Triaging fuzzer crashes in C\u002FC++** -- use a dedicated crash\n  triage skill\n\n## Pipeline Position\n\nThis skill is the quality gate between automated discovery and human\nreview. Findings that survive triage proceed to PoC development and\nformal writeup.\n\n```mermaid\nflowchart TD\n    A([agentic vulnerability discovery]) -->|raw findings| B[vulnerability-triage-brocards]\n    B -->|DISMISS| C([Document brocard # and reasoning])\n    B -->|NEEDS-MORE-INFO| D([Request specific evidence])\n    B -->|ACCEPT| E[PoC \u002F exploitability proof]\n    E --> F[vulnerability report writeup]\n```\n\n## Triage Workflow\n\nFor each incoming vulnerability report, evaluate it against all 7 brocards\nsequentially. By default, stop at the first DISMISS verdict and report it.\nIf the user requests a full evaluation, continue through all 7 brocards\nregardless of intermediate failures. For each brocard, record one of three\nverdicts:\n\n- **PASS** -- the report survives this test\n- **DISMISS** -- the report fails this test; document the reason\n- **NEEDS-MORE-INFO** -- insufficient evidence to evaluate; specify what is\n  missing\n\n### Brocard 1: No Vulnerability Without a Threat Model\n\nDismiss any report that lacks a coherent threat model. The report must\narticulate: (a) who the attacker is, (b) what capability the attacker has,\n(c) how the attacker exploits the behavior, and (d) what harm results.\n\nReports that describe a code behavior without connecting it to attacker-\nreachable harm fail this brocard.\n\n**Quick test:** Can the report answer \"an attacker with [capability] can\n[action] to achieve [impact]\"? If not, dismiss or request clarification.\n\n### Brocard 2: No Exploit from the Heavens\n\nDismiss any report where the attacker capabilities required to trigger the\nvulnerability equal or exceed the impact of the vulnerability itself. If the\nattacker must already possess the power the exploit would grant, the\nvulnerability is redundant.\n\n**Quick test:** Does triggering the exploit require capabilities that already\nsubsume its impact? If yes, dismiss.\n\n### Brocard 3: No Vulnerability Outside of Usage\n\nDismiss any report describing behavior that is theoretically possible but\ndoes not occur in actual software usage. Check whether the vulnerable code\npath is reachable in practice.\n\n**Quick test:** Is the vulnerable code path exercised by any real caller?\nIf not, dismiss. If the report targets a library, ask if we should check\ndownstream usage.\n\n### Brocard 4: No Vulnerability from Standard Behavior\n\nDismiss any report where the behavior results from correct implementation of\na specification. The vulnerability, if any, exists in the standard -- not the\nimplementation.\n\n**Nuance:** If an implementation voluntarily adopts a stricter posture than\nthe standard requires, and that strictness fails, the implementation *is*\nvulnerable even though the standard permits the behavior.\n\n**Quick test:** Does the specification require or permit this behavior? If\nyes, the report targets the standard, not the code.\n\n### Brocard 5: No Vulnerability from Documented Behavior\n\nDismiss any report describing behavior that is explicitly documented,\nespecially when the documentation includes security implications or usage\ncaveats.\n\n**Nuance:** Downstream usage that violates documented guidelines may\nconstitute a valid vulnerability in the *downstream* project, not the\ndocumented component.\n\n**Quick test:** Does the project's documentation describe this behavior and\nwarn against misuse? If yes, dismiss the report against the project itself.\n\n### Brocard 6: No Cure Worse Than the Disease\n\nDismiss any report whose remediation would cause more harm than the\nvulnerability itself. Evaluate: (a) severity of the vulnerability in\npractice, (b) cost and disruption of the proposed fix, (c) blast radius of\nthe remediation (dependency graph, ecosystem impact).\n\n**Quick test:** Would fixing this cause more disruption than the\nvulnerability itself? If yes, dismiss or downgrade severity.\n\n### Brocard 7: The Report Is Neither Necessary nor Sufficient\n\nA CVE identifier or formal report does not prove a vulnerability exists.\nConversely, absence of a report does not prove safety. Evaluate the\ntechnical merits independently of report metadata.\n\n**Quick test:** Strip the CVE number and CVSS score. Does the technical\ndescription alone justify action? Judge on evidence, not authority.\n\n## Output Format\n\nAfter evaluating all 7 brocards, produce a structured triage summary:\n\n```\n## Triage Summary: [Report ID or Title]\n\n| # | Brocard | Verdict | Rationale |\n|---|---------|---------|-----------|\n| 1 | Threat Model | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 2 | Exploit from the Heavens | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 3 | Outside of Usage | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 4 | Standard Behavior | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 5 | Documented Behavior | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 6 | Cure Worse Than Disease | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 7 | Report Sufficiency | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n\n**Overall Verdict:** ACCEPT \u002F DISMISS \u002F NEEDS-MORE-INFO\n**Reasoning:** [1-3 sentence justification]\n**Next Step:** [escalate to PoC development \u002F request info \u002F close]\n```\n\n## Rationalizations to Reject\n\nGuard against these reasoning failures in both directions:\n\n### Wrongly Dismissing Valid Findings\n\n- \"It's only reachable in debug mode\" -- verify debug mode is truly\n  never enabled in production; many clients ship with debug flags on\n- \"The attacker would need local access\" -- local access is a realistic\n  threat model for many deployments, especially containerized services\n- \"Nobody uses that API\" -- confirm with actual usage data, not\n  assumptions; check client's integration tests and deployment configs\n- \"The spec allows it\" -- check whether the implementation claims\n  stricter behavior than the spec requires\n\n### Wrongly Accepting Invalid Findings\n\n- \"It has a CVE, so it must be real\" -- Brocard 7 exists for this reason\n- \"The CVSS score is high\" -- CVSS is a formula, not a verdict\n- \"Better safe than sorry\" -- Brocard 6 requires evaluating fix cost\n- \"We can't prove it's NOT exploitable\" -- the burden of proof is on the\n  reporter to demonstrate a threat model (Brocard 1)\n- \"Other projects patched it\" -- other projects may have different usage\n  patterns (Brocard 3)\n- \"We should include it to pad the report\" -- ToB reports reflect\n  technical reality, not finding count targets; a dismissed report with\n  documented reasoning is more valuable than a false positive in a\n  final deliverable\n\n## Detailed References\n\nFor expanded explanations, examples, and edge cases for each brocard, consult\n[`references\u002Fbrocards-detail.md`](references\u002Fbrocards-detail.md).\n",{"data":42,"body":43},{"name":4,"description":6},{"type":44,"children":45},"root",[46,54,60,76,83,113,119,153,159,164,232,238,243,276,283,288,293,324,330,335,344,350,355,364,370,375,393,402,408,413,429,438,444,449,458,464,469,478,484,489,499,505,510,516,539,545,578,584,600],{"type":47,"tag":48,"props":49,"children":50},"element","h1",{"id":4},[51],{"type":52,"value":53},"text","Vulnerability Triage Brocards",{"type":47,"tag":55,"props":56,"children":57},"p",{},[58],{"type":52,"value":59},"Systematically evaluate incoming vulnerability reports against 7 principled\ncriteria before committing resources to deeper analysis. Each brocard is a\nfalsifiable test: if a report fails any brocard, document the reason and\ndismiss or request clarification. If a report survives all 7, escalate it.",{"type":47,"tag":55,"props":61,"children":62},{},[63,65,74],{"type":52,"value":64},"The 7 brocards are adapted from William Woodruff's\n",{"type":47,"tag":66,"props":67,"children":71},"a",{"href":68,"rel":69},"https:\u002F\u002Fblog.yossarian.net\u002F2026\u002F04\u002F11\u002FBrocards-for-vulnerability-triage",[70],"nofollow",[72],{"type":52,"value":73},"\"Brocards for vulnerability triage\"",{"type":52,"value":75},"\n(2026).",{"type":47,"tag":77,"props":78,"children":80},"h2",{"id":79},"when-to-use",[81],{"type":52,"value":82},"When to Use",{"type":47,"tag":84,"props":85,"children":86},"ul",{},[87,93,98,103,108],{"type":47,"tag":88,"props":89,"children":90},"li",{},[91],{"type":52,"value":92},"Filtering findings from agentic vulnerability discovery pipelines\nbefore human review -- the primary use case; most automated runs\nproduce findings that fail one or more brocards and can be dismissed\nwithout auditor time",{"type":47,"tag":88,"props":94,"children":95},{},[96],{"type":52,"value":97},"Triaging findings during a ToB audit to decide which warrant\nescalation to PoC development",{"type":47,"tag":88,"props":99,"children":100},{},[101],{"type":52,"value":102},"Evaluating third-party CVEs or advisories against a codebase under\nactive audit to decide if they affect engagement scope",{"type":47,"tag":88,"props":104,"children":105},{},[106],{"type":52,"value":107},"Reviewing bug bounty submissions or external vulnerability reports\nfor ToB open-source projects",{"type":47,"tag":88,"props":109,"children":110},{},[111],{"type":52,"value":112},"Providing structured, defensible justification when recommending a\nclient dismiss or deprioritize a reported CVE",{"type":47,"tag":77,"props":114,"children":116},{"id":115},"when-not-to-use",[117],{"type":52,"value":118},"When NOT to Use",{"type":47,"tag":84,"props":120,"children":121},{},[122,133,143],{"type":47,"tag":88,"props":123,"children":124},{},[125,131],{"type":47,"tag":126,"props":127,"children":128},"strong",{},[129],{"type":52,"value":130},"Hunting for new bugs during an audit",{"type":52,"value":132}," -- use other skills",{"type":47,"tag":88,"props":134,"children":135},{},[136,141],{"type":47,"tag":126,"props":137,"children":138},{},[139],{"type":52,"value":140},"Proving exploitability of a confirmed finding",{"type":52,"value":142}," -- use a\ndedicated PoC\u002Fexploitability skill",{"type":47,"tag":88,"props":144,"children":145},{},[146,151],{"type":47,"tag":126,"props":147,"children":148},{},[149],{"type":52,"value":150},"Triaging fuzzer crashes in C\u002FC++",{"type":52,"value":152}," -- use a dedicated crash\ntriage skill",{"type":47,"tag":77,"props":154,"children":156},{"id":155},"pipeline-position",[157],{"type":52,"value":158},"Pipeline Position",{"type":47,"tag":55,"props":160,"children":161},{},[162],{"type":52,"value":163},"This skill is the quality gate between automated discovery and human\nreview. Findings that survive triage proceed to PoC development and\nformal writeup.",{"type":47,"tag":165,"props":166,"children":171},"pre",{"className":167,"code":168,"language":169,"meta":170,"style":170},"language-mermaid shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","flowchart TD\n    A([agentic vulnerability discovery]) -->|raw findings| B[vulnerability-triage-brocards]\n    B -->|DISMISS| C([Document brocard # and reasoning])\n    B -->|NEEDS-MORE-INFO| D([Request specific evidence])\n    B -->|ACCEPT| E[PoC \u002F exploitability proof]\n    E --> F[vulnerability report writeup]\n","mermaid","",[172],{"type":47,"tag":173,"props":174,"children":175},"code",{"__ignoreMap":170},[176,187,196,205,214,223],{"type":47,"tag":177,"props":178,"children":181},"span",{"class":179,"line":180},"line",1,[182],{"type":47,"tag":177,"props":183,"children":184},{},[185],{"type":52,"value":186},"flowchart TD\n",{"type":47,"tag":177,"props":188,"children":190},{"class":179,"line":189},2,[191],{"type":47,"tag":177,"props":192,"children":193},{},[194],{"type":52,"value":195},"    A([agentic vulnerability discovery]) -->|raw findings| B[vulnerability-triage-brocards]\n",{"type":47,"tag":177,"props":197,"children":199},{"class":179,"line":198},3,[200],{"type":47,"tag":177,"props":201,"children":202},{},[203],{"type":52,"value":204},"    B -->|DISMISS| C([Document brocard # and reasoning])\n",{"type":47,"tag":177,"props":206,"children":208},{"class":179,"line":207},4,[209],{"type":47,"tag":177,"props":210,"children":211},{},[212],{"type":52,"value":213},"    B -->|NEEDS-MORE-INFO| D([Request specific evidence])\n",{"type":47,"tag":177,"props":215,"children":217},{"class":179,"line":216},5,[218],{"type":47,"tag":177,"props":219,"children":220},{},[221],{"type":52,"value":222},"    B -->|ACCEPT| E[PoC \u002F exploitability proof]\n",{"type":47,"tag":177,"props":224,"children":226},{"class":179,"line":225},6,[227],{"type":47,"tag":177,"props":228,"children":229},{},[230],{"type":52,"value":231},"    E --> F[vulnerability report writeup]\n",{"type":47,"tag":77,"props":233,"children":235},{"id":234},"triage-workflow",[236],{"type":52,"value":237},"Triage Workflow",{"type":47,"tag":55,"props":239,"children":240},{},[241],{"type":52,"value":242},"For each incoming vulnerability report, evaluate it against all 7 brocards\nsequentially. By default, stop at the first DISMISS verdict and report it.\nIf the user requests a full evaluation, continue through all 7 brocards\nregardless of intermediate failures. For each brocard, record one of three\nverdicts:",{"type":47,"tag":84,"props":244,"children":245},{},[246,256,266],{"type":47,"tag":88,"props":247,"children":248},{},[249,254],{"type":47,"tag":126,"props":250,"children":251},{},[252],{"type":52,"value":253},"PASS",{"type":52,"value":255}," -- the report survives this test",{"type":47,"tag":88,"props":257,"children":258},{},[259,264],{"type":47,"tag":126,"props":260,"children":261},{},[262],{"type":52,"value":263},"DISMISS",{"type":52,"value":265}," -- the report fails this test; document the reason",{"type":47,"tag":88,"props":267,"children":268},{},[269,274],{"type":47,"tag":126,"props":270,"children":271},{},[272],{"type":52,"value":273},"NEEDS-MORE-INFO",{"type":52,"value":275}," -- insufficient evidence to evaluate; specify what is\nmissing",{"type":47,"tag":277,"props":278,"children":280},"h3",{"id":279},"brocard-1-no-vulnerability-without-a-threat-model",[281],{"type":52,"value":282},"Brocard 1: No Vulnerability Without a Threat Model",{"type":47,"tag":55,"props":284,"children":285},{},[286],{"type":52,"value":287},"Dismiss any report that lacks a coherent threat model. The report must\narticulate: (a) who the attacker is, (b) what capability the attacker has,\n(c) how the attacker exploits the behavior, and (d) what harm results.",{"type":47,"tag":55,"props":289,"children":290},{},[291],{"type":52,"value":292},"Reports that describe a code behavior without connecting it to attacker-\nreachable harm fail this brocard.",{"type":47,"tag":55,"props":294,"children":295},{},[296,301,303,308,310,315,317,322],{"type":47,"tag":126,"props":297,"children":298},{},[299],{"type":52,"value":300},"Quick test:",{"type":52,"value":302}," Can the report answer \"an attacker with ",{"type":47,"tag":177,"props":304,"children":305},{},[306],{"type":52,"value":307},"capability",{"type":52,"value":309}," can\n",{"type":47,"tag":177,"props":311,"children":312},{},[313],{"type":52,"value":314},"action",{"type":52,"value":316}," to achieve ",{"type":47,"tag":177,"props":318,"children":319},{},[320],{"type":52,"value":321},"impact",{"type":52,"value":323},"\"? If not, dismiss or request clarification.",{"type":47,"tag":277,"props":325,"children":327},{"id":326},"brocard-2-no-exploit-from-the-heavens",[328],{"type":52,"value":329},"Brocard 2: No Exploit from the Heavens",{"type":47,"tag":55,"props":331,"children":332},{},[333],{"type":52,"value":334},"Dismiss any report where the attacker capabilities required to trigger the\nvulnerability equal or exceed the impact of the vulnerability itself. If the\nattacker must already possess the power the exploit would grant, the\nvulnerability is redundant.",{"type":47,"tag":55,"props":336,"children":337},{},[338,342],{"type":47,"tag":126,"props":339,"children":340},{},[341],{"type":52,"value":300},{"type":52,"value":343}," Does triggering the exploit require capabilities that already\nsubsume its impact? If yes, dismiss.",{"type":47,"tag":277,"props":345,"children":347},{"id":346},"brocard-3-no-vulnerability-outside-of-usage",[348],{"type":52,"value":349},"Brocard 3: No Vulnerability Outside of Usage",{"type":47,"tag":55,"props":351,"children":352},{},[353],{"type":52,"value":354},"Dismiss any report describing behavior that is theoretically possible but\ndoes not occur in actual software usage. Check whether the vulnerable code\npath is reachable in practice.",{"type":47,"tag":55,"props":356,"children":357},{},[358,362],{"type":47,"tag":126,"props":359,"children":360},{},[361],{"type":52,"value":300},{"type":52,"value":363}," Is the vulnerable code path exercised by any real caller?\nIf not, dismiss. If the report targets a library, ask if we should check\ndownstream usage.",{"type":47,"tag":277,"props":365,"children":367},{"id":366},"brocard-4-no-vulnerability-from-standard-behavior",[368],{"type":52,"value":369},"Brocard 4: No Vulnerability from Standard Behavior",{"type":47,"tag":55,"props":371,"children":372},{},[373],{"type":52,"value":374},"Dismiss any report where the behavior results from correct implementation of\na specification. The vulnerability, if any, exists in the standard -- not the\nimplementation.",{"type":47,"tag":55,"props":376,"children":377},{},[378,383,385,391],{"type":47,"tag":126,"props":379,"children":380},{},[381],{"type":52,"value":382},"Nuance:",{"type":52,"value":384}," If an implementation voluntarily adopts a stricter posture than\nthe standard requires, and that strictness fails, the implementation ",{"type":47,"tag":386,"props":387,"children":388},"em",{},[389],{"type":52,"value":390},"is",{"type":52,"value":392},"\nvulnerable even though the standard permits the behavior.",{"type":47,"tag":55,"props":394,"children":395},{},[396,400],{"type":47,"tag":126,"props":397,"children":398},{},[399],{"type":52,"value":300},{"type":52,"value":401}," Does the specification require or permit this behavior? If\nyes, the report targets the standard, not the code.",{"type":47,"tag":277,"props":403,"children":405},{"id":404},"brocard-5-no-vulnerability-from-documented-behavior",[406],{"type":52,"value":407},"Brocard 5: No Vulnerability from Documented Behavior",{"type":47,"tag":55,"props":409,"children":410},{},[411],{"type":52,"value":412},"Dismiss any report describing behavior that is explicitly documented,\nespecially when the documentation includes security implications or usage\ncaveats.",{"type":47,"tag":55,"props":414,"children":415},{},[416,420,422,427],{"type":47,"tag":126,"props":417,"children":418},{},[419],{"type":52,"value":382},{"type":52,"value":421}," Downstream usage that violates documented guidelines may\nconstitute a valid vulnerability in the ",{"type":47,"tag":386,"props":423,"children":424},{},[425],{"type":52,"value":426},"downstream",{"type":52,"value":428}," project, not the\ndocumented component.",{"type":47,"tag":55,"props":430,"children":431},{},[432,436],{"type":47,"tag":126,"props":433,"children":434},{},[435],{"type":52,"value":300},{"type":52,"value":437}," Does the project's documentation describe this behavior and\nwarn against misuse? If yes, dismiss the report against the project itself.",{"type":47,"tag":277,"props":439,"children":441},{"id":440},"brocard-6-no-cure-worse-than-the-disease",[442],{"type":52,"value":443},"Brocard 6: No Cure Worse Than the Disease",{"type":47,"tag":55,"props":445,"children":446},{},[447],{"type":52,"value":448},"Dismiss any report whose remediation would cause more harm than the\nvulnerability itself. Evaluate: (a) severity of the vulnerability in\npractice, (b) cost and disruption of the proposed fix, (c) blast radius of\nthe remediation (dependency graph, ecosystem impact).",{"type":47,"tag":55,"props":450,"children":451},{},[452,456],{"type":47,"tag":126,"props":453,"children":454},{},[455],{"type":52,"value":300},{"type":52,"value":457}," Would fixing this cause more disruption than the\nvulnerability itself? If yes, dismiss or downgrade severity.",{"type":47,"tag":277,"props":459,"children":461},{"id":460},"brocard-7-the-report-is-neither-necessary-nor-sufficient",[462],{"type":52,"value":463},"Brocard 7: The Report Is Neither Necessary nor Sufficient",{"type":47,"tag":55,"props":465,"children":466},{},[467],{"type":52,"value":468},"A CVE identifier or formal report does not prove a vulnerability exists.\nConversely, absence of a report does not prove safety. Evaluate the\ntechnical merits independently of report metadata.",{"type":47,"tag":55,"props":470,"children":471},{},[472,476],{"type":47,"tag":126,"props":473,"children":474},{},[475],{"type":52,"value":300},{"type":52,"value":477}," Strip the CVE number and CVSS score. Does the technical\ndescription alone justify action? Judge on evidence, not authority.",{"type":47,"tag":77,"props":479,"children":481},{"id":480},"output-format",[482],{"type":52,"value":483},"Output Format",{"type":47,"tag":55,"props":485,"children":486},{},[487],{"type":52,"value":488},"After evaluating all 7 brocards, produce a structured triage summary:",{"type":47,"tag":165,"props":490,"children":494},{"className":491,"code":493,"language":52},[492],"language-text","## Triage Summary: [Report ID or Title]\n\n| # | Brocard | Verdict | Rationale |\n|---|---------|---------|-----------|\n| 1 | Threat Model | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 2 | Exploit from the Heavens | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 3 | Outside of Usage | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 4 | Standard Behavior | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 5 | Documented Behavior | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 6 | Cure Worse Than Disease | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n| 7 | Report Sufficiency | PASS\u002FDISMISS\u002FNEEDS-MORE-INFO | ... |\n\n**Overall Verdict:** ACCEPT \u002F DISMISS \u002F NEEDS-MORE-INFO\n**Reasoning:** [1-3 sentence justification]\n**Next Step:** [escalate to PoC development \u002F request info \u002F close]\n",[495],{"type":47,"tag":173,"props":496,"children":497},{"__ignoreMap":170},[498],{"type":52,"value":493},{"type":47,"tag":77,"props":500,"children":502},{"id":501},"rationalizations-to-reject",[503],{"type":52,"value":504},"Rationalizations to Reject",{"type":47,"tag":55,"props":506,"children":507},{},[508],{"type":52,"value":509},"Guard against these reasoning failures in both directions:",{"type":47,"tag":277,"props":511,"children":513},{"id":512},"wrongly-dismissing-valid-findings",[514],{"type":52,"value":515},"Wrongly Dismissing Valid Findings",{"type":47,"tag":84,"props":517,"children":518},{},[519,524,529,534],{"type":47,"tag":88,"props":520,"children":521},{},[522],{"type":52,"value":523},"\"It's only reachable in debug mode\" -- verify debug mode is truly\nnever enabled in production; many clients ship with debug flags on",{"type":47,"tag":88,"props":525,"children":526},{},[527],{"type":52,"value":528},"\"The attacker would need local access\" -- local access is a realistic\nthreat model for many deployments, especially containerized services",{"type":47,"tag":88,"props":530,"children":531},{},[532],{"type":52,"value":533},"\"Nobody uses that API\" -- confirm with actual usage data, not\nassumptions; check client's integration tests and deployment configs",{"type":47,"tag":88,"props":535,"children":536},{},[537],{"type":52,"value":538},"\"The spec allows it\" -- check whether the implementation claims\nstricter behavior than the spec requires",{"type":47,"tag":277,"props":540,"children":542},{"id":541},"wrongly-accepting-invalid-findings",[543],{"type":52,"value":544},"Wrongly Accepting Invalid Findings",{"type":47,"tag":84,"props":546,"children":547},{},[548,553,558,563,568,573],{"type":47,"tag":88,"props":549,"children":550},{},[551],{"type":52,"value":552},"\"It has a CVE, so it must be real\" -- Brocard 7 exists for this reason",{"type":47,"tag":88,"props":554,"children":555},{},[556],{"type":52,"value":557},"\"The CVSS score is high\" -- CVSS is a formula, not a verdict",{"type":47,"tag":88,"props":559,"children":560},{},[561],{"type":52,"value":562},"\"Better safe than sorry\" -- Brocard 6 requires evaluating fix cost",{"type":47,"tag":88,"props":564,"children":565},{},[566],{"type":52,"value":567},"\"We can't prove it's NOT exploitable\" -- the burden of proof is on the\nreporter to demonstrate a threat model (Brocard 1)",{"type":47,"tag":88,"props":569,"children":570},{},[571],{"type":52,"value":572},"\"Other projects patched it\" -- other projects may have different usage\npatterns (Brocard 3)",{"type":47,"tag":88,"props":574,"children":575},{},[576],{"type":52,"value":577},"\"We should include it to pad the report\" -- ToB reports reflect\ntechnical reality, not finding count targets; a dismissed report with\ndocumented reasoning is more valuable than a false positive in a\nfinal deliverable",{"type":47,"tag":77,"props":579,"children":581},{"id":580},"detailed-references",[582],{"type":52,"value":583},"Detailed References",{"type":47,"tag":55,"props":585,"children":586},{},[587,589,598],{"type":52,"value":588},"For expanded explanations, examples, and edge cases for each brocard, consult\n",{"type":47,"tag":66,"props":590,"children":592},{"href":591},"references\u002Fbrocards-detail.md",[593],{"type":47,"tag":173,"props":594,"children":596},{"className":595},[],[597],{"type":52,"value":591},{"type":52,"value":599},".",{"type":47,"tag":601,"props":602,"children":603},"style",{},[604],{"type":52,"value":605},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":607,"total":759},[608,625,635,653,666,679,691,701,714,725,737,748],{"slug":609,"name":609,"fn":610,"description":611,"org":612,"tags":613,"stars":29,"repoUrl":30,"updatedAt":624},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[614,617,620,621],{"name":615,"slug":616,"type":16},"C#","c",{"name":618,"slug":619,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":622,"slug":623,"type":16},"Testing","testing","2026-07-17T06:05:14.925095",{"slug":626,"name":626,"fn":627,"description":628,"org":629,"tags":630,"stars":29,"repoUrl":30,"updatedAt":634},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[631,632,633],{"name":615,"slug":616,"type":16},{"name":14,"slug":15,"type":16},{"name":622,"slug":623,"type":16},"2026-07-17T06:05:12.433192",{"slug":636,"name":636,"fn":637,"description":638,"org":639,"tags":640,"stars":29,"repoUrl":30,"updatedAt":652},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[641,644,647,648,651],{"name":642,"slug":643,"type":16},"Agents","agents",{"name":645,"slug":646,"type":16},"CI\u002FCD","ci-cd",{"name":24,"slug":25,"type":16},{"name":649,"slug":650,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":654,"name":654,"fn":655,"description":656,"org":657,"tags":658,"stars":29,"repoUrl":30,"updatedAt":665},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[659,660,661,662],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":663,"slug":664,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":667,"name":667,"fn":668,"description":669,"org":670,"tags":671,"stars":29,"repoUrl":30,"updatedAt":678},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[672,675],{"name":673,"slug":674,"type":16},"Engineering","engineering",{"name":676,"slug":677,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":680,"name":680,"fn":681,"description":682,"org":683,"tags":684,"stars":29,"repoUrl":30,"updatedAt":690},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[685,688,689],{"name":686,"slug":687,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":622,"slug":623,"type":16},"2026-07-17T06:05:14.575191",{"slug":692,"name":692,"fn":693,"description":694,"org":695,"tags":696,"stars":29,"repoUrl":30,"updatedAt":700},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[697,698,699],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":702,"name":702,"fn":703,"description":704,"org":705,"tags":706,"stars":29,"repoUrl":30,"updatedAt":713},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[707,710,711,712],{"name":708,"slug":709,"type":16},"Architecture","architecture",{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":673,"slug":674,"type":16},"2026-07-18T05:47:40.122449",{"slug":715,"name":715,"fn":716,"description":717,"org":718,"tags":719,"stars":29,"repoUrl":30,"updatedAt":724},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[720,721,722,723],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":673,"slug":674,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":726,"name":726,"fn":727,"description":728,"org":729,"tags":730,"stars":29,"repoUrl":30,"updatedAt":736},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[731,732,735],{"name":18,"slug":19,"type":16},{"name":733,"slug":734,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":738,"name":738,"fn":739,"description":740,"org":741,"tags":742,"stars":29,"repoUrl":30,"updatedAt":747},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[743,744,745,746],{"name":18,"slug":19,"type":16},{"name":615,"slug":616,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":749,"name":749,"fn":750,"description":751,"org":752,"tags":753,"stars":29,"repoUrl":30,"updatedAt":758},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[754,755,756,757],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":663,"slug":664,"type":16},"2026-07-18T05:47:42.84568",111,{"items":761,"total":807},[762,769,775,783,790,795,801],{"slug":609,"name":609,"fn":610,"description":611,"org":763,"tags":764,"stars":29,"repoUrl":30,"updatedAt":624},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[765,766,767,768],{"name":615,"slug":616,"type":16},{"name":618,"slug":619,"type":16},{"name":14,"slug":15,"type":16},{"name":622,"slug":623,"type":16},{"slug":626,"name":626,"fn":627,"description":628,"org":770,"tags":771,"stars":29,"repoUrl":30,"updatedAt":634},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[772,773,774],{"name":615,"slug":616,"type":16},{"name":14,"slug":15,"type":16},{"name":622,"slug":623,"type":16},{"slug":636,"name":636,"fn":637,"description":638,"org":776,"tags":777,"stars":29,"repoUrl":30,"updatedAt":652},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[778,779,780,781,782],{"name":642,"slug":643,"type":16},{"name":645,"slug":646,"type":16},{"name":24,"slug":25,"type":16},{"name":649,"slug":650,"type":16},{"name":14,"slug":15,"type":16},{"slug":654,"name":654,"fn":655,"description":656,"org":784,"tags":785,"stars":29,"repoUrl":30,"updatedAt":665},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[786,787,788,789],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":663,"slug":664,"type":16},{"slug":667,"name":667,"fn":668,"description":669,"org":791,"tags":792,"stars":29,"repoUrl":30,"updatedAt":678},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[793,794],{"name":673,"slug":674,"type":16},{"name":676,"slug":677,"type":16},{"slug":680,"name":680,"fn":681,"description":682,"org":796,"tags":797,"stars":29,"repoUrl":30,"updatedAt":690},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[798,799,800],{"name":686,"slug":687,"type":16},{"name":14,"slug":15,"type":16},{"name":622,"slug":623,"type":16},{"slug":692,"name":692,"fn":693,"description":694,"org":802,"tags":803,"stars":29,"repoUrl":30,"updatedAt":700},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[804,805,806],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},77]