vuln-triage · diff
git:20260715.c69bff9 to git:20260723.6e5370b
77 added, 33 removed. Audit A to A.
---
name: vuln-triage
- description: Triage dependency or ecosystem vulnerability risk into remediation and advisory packets, grounding on verified CVE evidence when it is supplied.
+ description: Turn verified exact-version vulnerability evidence into bounded remediation and advisory packets without inventing exposure or claiming publication.
runx:
category: security
---
# Vulnerability Triage
- Take a dependency surface or project scope and produce a bounded security
- packet: what is affected, how serious it is, what to do next, and whether a
- public advisory is justified. This is the judgment layer, for operator-facing
- risk analysis, remediation planning, and advisory drafting. It is not a license
- to run arbitrary destructive scans.
+ Translate verified vulnerability identities into an operator decision: what is
+ affected, what exposure is established or unknown, how urgent the response is,
+ what remediation is justified, and whether an advisory should be prepared. This
+ is the judgment layer of the security chain, not another scanner.
- When `cve_evidence` is supplied (the verified, exact-version findings a
- `cve-audit` run seals), triage those confirmed facts rather than inferring
- exposure. That is the intended chain: deterministic evidence from `cve-audit`
- flows into this judgment, and the drafted advisory flows on to `vuln-disclosure`.
- Without it, analyze the target surface directly.
+ Use `cve-audit` first to prove the exact dependency versions and OSV advisory
+ identities. `vuln-triage` then reasons about operational exposure and priority
+ without changing those facts. An advisory draft can later move to
+ `vuln-disclosure`, which owns the publication boundary.
- Cite package data, versions, advisories, scan output, commits, or other concrete
- evidence for every exposure claim. Separate confirmed exposure from possible
- risk and write calmly: no vague severity, alarmism, or public disclosure claim
- without evidence and authorization. Return `needs_more_evidence`,
- `needs_human`, or `do_not_publish_advisory` when affected versions, exposure,
- remediation, or disclosure posture cannot be verified.
+ ## Runners
- ## Output
+ `scan` accepts the exact CVE audit result, its independent verification packet,
+ and the sealed receipt reference. Every assessment remains bound to dependency,
+ installed version, and advisory id. Judgment may classify priority, distinguish
+ established from unknown exposure, and propose remediation, but confidence must
+ describe only that judgment—the CVE identity is already verified.
- Scan runner:
+ `advisory` accepts only a validated triage packet. It prepares precise wording
+ for the admitted advisory ids and returns a review packet with
+ `publication_status: not_published`. It does not call a repository, advisory,
+ email, or social provider.
- - `dependency_inventory`: affected components and versions.
- - `advisories`: findings with severity, exposure, and evidence.
- - `remediation_plan`: concrete next actions.
- - `operator_summary`: concise decision-ready summary.
+ ## Operating standard
- Advisory runner:
+ - Keep verified identity, exposure judgment, and remediation confidence
+ separate.
+ - State affected versions, preconditions, impact, and mitigations precisely.
+ - Treat unknown exposure as a reason to investigate or escalate, not as proof of
+ exploitation or safety.
+ - Avoid alarmism and vague severity labels. Explain the operational reason for
+ priority and the evidence still missing.
+ - Preserve every verified finding. Adding a new CVE or silently omitting one
+ invalidates the packet.
- - `advisory_draft`: public or maintainer-facing advisory text.
- - `maintainer_summary`: concise summary for repo owners.
- - `disclosure_checklist`: what to verify before public release.
+ The finalized triage packet adds deterministic escalation criteria for high
+ priority, unknown exposure, and low-confidence judgments. A clean audit returns
+ `no_verified_findings`; it does not certify the target secure.
- ## Inputs
+ ## Inputs and result
- - `target` (required): repo, lockfile, package set, or ecosystem slice.
- - `objective` (optional): what the operator wants from this scan.
- - `scan_context` (optional): known packages, incidents, or prior findings.
- - `advisories` (optional): structured findings from the scan runner.
- - `remediation_plan` (optional): structured remediation plan for the advisory pass.
+ The scan runner consumes the target-bound audit result, verification result, and
+ receipt reference plus any bounded operational context needed to assess
+ exposure. It returns one assessment per verified finding, a remediation plan,
+ operator summary, evidence binding, confidence, and escalation criteria.
+
+ The advisory runner consumes that validated triage packet and returns a title,
+ summary, body, exact affected advisory ids, and disclosure checklist. That
+ artifact is a draft for review, not external publication.
+
+ ## Stop conditions
+
+ - Return `needs_verified_evidence` when the audit, independent verification, or
+ receipt reference is missing or invalid.
+ - Return `needs_more_evidence` when an assessment adds or omits a finding,
+ changes a version or advisory identity, or lacks bounded confidence.
+ - Reject advisory wording that cites an unknown id or states exposure the
+ triage packet did not establish.
+ - Never mutate the target, query another provider, repair dependencies, or
+ claim disclosure.
+
+ ## Example
+
+ An audit proves that exact version `x.y.z` matches one OSV advisory. Triage may
+ find that the vulnerable code path is reachable, assign high priority, and
+ recommend a tested upgrade; or it may record exposure as unknown and request a
+ named runtime trace. It cannot add a related CVE from memory. The advisory draft
+ may describe only the admitted finding and the remediation evidence present in
+ the packet.
+
+ ## Agent task contracts
+
+ ### `vuln-triage-assess`
+
+ Assess only the verified finding identities. Return one assessment per exact
+ dependency, version, and advisory id plus the remediation plan and operator
+ summary. State high, medium, or low confidence for exposure and priority
+ judgment. Do not add CVEs, versions, provider claims, or publication claims.
+
+ ### `vuln-triage-advisory`
+
+ Draft a precise advisory using only the admitted advisory ids, target,
+ remediation, and evidence binding. Return the affected ids and disclosure
+ checklist with the draft. Do not claim publication, provider execution, or
+ exposure that the triage packet does not establish.