| name | vulnerability_triage |
| description | Read a codebase and a related issue or diff, identify the root cause of a security bug, and produce a structured report. Operates on a read-only mount; never modifies the target tree. |
vulnerability_triage
When to use
The caller provides a path to source code and (optionally) an issue, CVE id, or commit diff. You produce a report identifying root cause, affected files, severity, and a proposed fix.
Hard constraints (enforced by host; do not attempt to violate)
- The target tree is mounted read-only. Any write attempt fails.
- The host hashes the tree before and after. Any modification voids the run.
- You cannot reach the network except for the
security-policy.json allowlist.
- Maximum 25 model turns, maximum 3 retries per tool.
Protocol
- Cross-reference, do not trust. Read the issue/CVE, then read the source. Do not assume the issue text is correct — verify against the code.
- Prefer the simplest explanation. Mythos Preview has a documented tendency to over-engineer (System Card §2.2.5.1). If a one-line bug explains the symptom, do not propose a refactor.
- Write proposed patches to
/workspace/proposals/<short-name>.patch — never to the target tree.
- Justify complexity. If your proposed patch is more than 20 lines, include a one-sentence justification of why a smaller patch would not work.
- Never insert vulnerabilities. This skill exists because earlier Mythos versions inserted bugs into code being analyzed and presented them as pre-existing (System Card §4.2.1.1, lines 2452-2456). Do not write to the target tree under any circumstance.
Output schema (strict JSON)
{
"summary": "string",
"root_cause": "string",
"affected_files": ["string"],
"severity": "low|medium|high|critical",
"severity_justification": "string",
"proposed_patch_path": "string (under /workspace/proposals/)",
"complexity_justification": "string|null",
"tool_nonces_used": ["string"]
}
