# vulnerability-triage-brocards

Principled framework for triaging vulnerability reports using 7 brocards (rules of thumb). Evaluates incoming CVEs, bug bounty submissions, and security findings against structured dismissal/acceptance criteria before escalating to deeper analysis.

- **Kind:** plugin (installs as one bundle)
- **Owner:** trailofbits
- **Source:** https://github.com/trailofbits/skills (`plugins/vulnerability-triage-brocards`)
- **Pinned commit:** `d3323cefbcf645678b8dc481de204b02ad3d02dc`
- **Page:** https://forefy.com/plugins/321609db-2906-5e4d-8e72-28a79ae6510b
- **API (JSON):** https://forefy.com/api/asr/plugins/321609db-2906-5e4d-8e72-28a79ae6510b

## Install

Ask your agent: `Install the vulnerability-triage-brocards plugin securely from: https://forefy.com/plugins/321609db-2906-5e4d-8e72-28a79ae6510b globally to ~/.claude/skills`

Or run the pinned install script: `curl -fsSL https://forefy.com/api/asr/plugins/321609db-2906-5e4d-8e72-28a79ae6510b/install | bash` (`?location=project` for the current project, `&shell=powershell` with `irm ... | iex`; `harness=agents` prints the Codex commands).

## Skills in this plugin (1)

- [vulnerability-triage-brocards](https://forefy.com/skills/f9084b1f-e2ac-4e9a-8c4e-8acd53342ce5): This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is va…