Agent Plugins Marketplace
← All plugins

vulnerability-triage-brocards

v0.1.2

Principled framework for triaging vulnerability reports using 7 brocards (rules of thumb). Evaluates incoming CVEs, bug bounty submissions, and security findings against structured dismissal/acceptance criteria before escalating to deeper analysis.

Claude Code1 Skill

By Alexis Challande7.1k GitHub starsUpdated last week

Directory evidence

Runtimes
Claude Code
Parsed components
1 skill or MCP entry
Source updated
Sep 16, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install vulnerability-triage-brocards for Claude Code

Installs for the current user
claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install vulnerability-triage-brocards@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/trailofbits/skills

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/vulnerability-triage-brocards/.

Plugin files

plugins/vulnerability-triage-brocards/
├── .claude-plugin/plugin.json
└── skills/vulnerability-triage-brocards/SKILL.md

Included Skills1

vulnerability-triage-brocardsskills/vulnerability-triage-brocards/SKILL.md

This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.

Plugin manifests1

plugins/vulnerability-triage-brocards/.claude-plugin/plugin.json
{
  "name": "vulnerability-triage-brocards",
  "version": "0.1.2",
  "description": "Principled framework for triaging vulnerability reports using 7 brocards (rules of thumb). Evaluates incoming CVEs, bug bounty submissions, and security findings against structured dismissal/acceptance criteria before escalating to deeper analysis.",
  "author": {
    "name": "Alexis Challande",
    "email": "[email protected]",
    "url": "https://github.com/trailofbits"
  },
  "interface": {
    "displayName": "Vulnerability Triage Brocards",
    "shortDescription": "Triages CVEs, bug bounty submissions, and security findings using seven rules of thumb to decide when deeper analysis is warranted.",
    "longDescription": "Principled framework for triaging vulnerability reports using 7 brocards (rules of thumb). Evaluates incoming CVEs, bug bounty submissions, and security findings against structured dismissal/acceptance criteria before escalating to deeper analysis.",
    "developerName": "Alexis Challande"
  }
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[vulnerability-triage-brocards on Agent Plugins Marketplace](https://pluginsmp.com/plugins/vulnerability-triage-brocards)