Menu

Individual skill

triage-security-finding

Use when exactly one concrete security finding with a source anchor needs a verdict before PoC work. Not for projecting batches of findings onto a graph: use project-findings-onto-graph.

.devin/skills/triage-security-finding/SKILL.md

Read pinned source

Source commit b0e8ce89a19fac880251dc3ea1babfeb4503a4fe

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Instructions only
Last checked
Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
55
Repository last updated
Sep 28, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Triage a security finding

One finding, one verdict. This skill takes a single anchored finding and produces the evidence packet a PoC effort needs: where the anchor binds, whether external input reaches it, which trust boundaries sit on the path, how far a confirmed vulnerability would spread, what a human must still judge, and what the analysis could not see. Batch imports and review gates are different jobs; exactly one finding is triaged per invocation.

## Contract

| Field | Bound contract |
|---|---|
| Trigger | Exactly one concrete finding, SARIF result, reviewer annotation, suspicious function, or report excerpt has a bindable source anchor and needs prioritization before PoC work. |
| Authority | Reversible local: writes only a single-candidate evidence packet file and optional graph annotations on the target; rollback is deleting those artifacts. No remote mutation. |
| Side effect | A single-candidate evidence packet file and optional graph annotations on the target. |
| Done | One Promote, Needs manual review, Deprioritize, or Blocked verdict is emitted with binding, reachability, boundaries, blast radius, manual review targets, and limitations. |

## Inputs