| name | cyberedge-report-findings |
| description | Report and query evidence-backed security findings from authorized CyberEdge Tasks. Use for versioned scanner adapters that classify existing Observations, never for arbitrary command or PoC execution. |
CyberEdge Report Findings
Use cyberedge-agent. This bridge is machine-only.
Evidence boundary
- Report only against a running or completed Task.
- Reference an Observation belonging to that exact Task. The server derives Asset and Evidence IDs; never invent them.
- Use a stable detector name, versioned rule ID, and deterministic fingerprint.
- Severity is
1=INFO, 2=LOW, 3=MEDIUM, 4=HIGH, or 5=CRITICAL.
- Do not execute commands, upload templates, edit PoCs, or widen Scope through this Skill.
The server deduplicates by Scope, detector, rule, Asset, and fingerprint. A repeated observation refreshes the existing Finding instead of creating noise.
{"request_id":"req-1","idempotency_key":"idem-1","agent_id":"codex-main","skill_name":"cyberedge-report-findings","skill_version":"0.1.0","action":"report_finding","task_id":"task-id","observation_id":"observation-id","detector":"adapter-name","rule_id":"rule-id","title":"Finding title","description":"Evidence-backed description","severity":3,"fingerprint":"stable-fingerprint"}
Use search_findings with scope_id for the resulting read model and get_task_report for the complete Evidence chain.
