Run any Skill in Manus with one click

reachability-triage

Stars1

Forks0

UpdatedMay 30, 2026 at 20:38

Triage a candidate finding by deciding whether the vulnerable code is reachable from an untrusted entry point, producing the reachability axis (0-1) that feeds asec-confidence. Use when the user asks to triage a finding or assess exploitability.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

theagenticguy

theagenticguy/agentic-security-lab

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	reachability-triage
description	Triage a candidate finding by deciding whether the vulnerable code is reachable from an untrusted entry point, producing the reachability axis (0-1) that feeds asec-confidence. Use when the user asks to triage a finding or assess exploitability.
allowed-tools	Read Grep Glob Bash(git diff ) Bash(semgrep )
argument-hint	["finding-file-or-location"]
context	fork
agent	general-purpose

Finding under triage

@$ARGUMENTS[0]

Task (v1.2 spec)

Identify the sink: the exact file:line and the dangerous operation (the candidate CWE).
Identify untrusted sources: external entry points (HTTP handlers, CLI args, deserialized input, message consumers). Enumerate them from entrypoints and route/handler registration.
Trace call paths from each source to the sink using Grep/Read (and semgrep taint queries when available). Record the shortest concrete path or prove none exists.
Classify reachability:
- 1.0 — direct, unconditional path from an untrusted source to the sink.
- 0.6-0.9 — reachable but guarded (auth, validation, feature flag); note the guard.
- 0.1-0.5 — reachable only via an unlikely or internal-only path.
- 0.0 — no path from any untrusted source (dead code, test-only, fully gated).
Note sanitizers/validators on the path that would neutralize the input, and whether they are complete.

Emit a JSON block matching the reachability field of asec_confidence.ConfidenceInputs:

{"reachability": 0.0, "sink": "file:line", "sources": ["..."], "path": ["..."], "guards": ["..."], "rationale": "..."}

This axis is one of three (pattern, recall, reachability) the BaselineStrategy weights; it owns the reachability portion of E18. Do not modify source files. Report only.

More from this repository

same repository

variant-analysis

theagenticguy/agentic-security-lab

Big-Sleep variant analysis. Given a recently-fixed bug shape (the lines added/removed in a patch), find more code in the repository that has the same shape and is likely to carry the same defect. Reports variants linked to their seed. Deny-by-default: only the allowed_tools below are permitted.

2026-06-011

security-code-review

theagenticguy/agentic-security-lab

Review a code diff or corpus for security vulnerabilities grounded in the supplied threat model. Reads code semantically, forms hypotheses, verifies them, and emits scored findings as a single JSON code block. Deny-by-default: only the allowed_tools below are permitted.

2026-06-011

threat-model-bootstrap

theagenticguy/agentic-security-lab

Given an architecture description or diagram, produce a STRIDE threat model plus attack trees as YAML. Use when the user asks to threat model a system.

2026-05-311

security-code-review

theagenticguy/agentic-security-lab

Review a git diff for vulnerabilities by running Semgrep and CodeQL, then emit structured findings. Use when the user asks for a security review of a diff/PR.

2026-05-301

threat-model-bootstrap

theagenticguy/agentic-security-lab

Given an architecture description, diagram, or repo, produce a Phase-Zero STRIDE threat model plus attack trees as YAML conforming to asec-threat-model schema. Use when the user asks to bootstrap or create a threat model for a system.

2026-05-301

threat-model-critic

theagenticguy/agentic-security-lab

Critique an existing threat model for completeness and rigor — missing STRIDE categories, unjustified skips, weak mitigations, ungrounded likelihood/impact. Use when the user asks to review, critique, or red-team a threat-model.yaml.

2026-05-301

name	reachability-triage
description	Triage a candidate finding by deciding whether the vulnerable code is reachable from an untrusted entry point, producing the reachability axis (0-1) that feeds asec-confidence. Use when the user asks to triage a finding or assess exploitability.
allowed-tools	Read Grep Glob Bash(git diff ) Bash(semgrep )
argument-hint	["finding-file-or-location"]
context	fork
agent	general-purpose

Finding under triage

@$ARGUMENTS[0]

Task (v1.2 spec)

Identify the sink: the exact file:line and the dangerous operation (the candidate CWE).
Identify untrusted sources: external entry points (HTTP handlers, CLI args, deserialized input, message consumers). Enumerate them from entrypoints and route/handler registration.
Trace call paths from each source to the sink using Grep/Read (and semgrep taint queries when available). Record the shortest concrete path or prove none exists.
Classify reachability:
- 1.0 — direct, unconditional path from an untrusted source to the sink.
- 0.6-0.9 — reachable but guarded (auth, validation, feature flag); note the guard.
- 0.1-0.5 — reachable only via an unlikely or internal-only path.
- 0.0 — no path from any untrusted source (dead code, test-only, fully gated).
Note sanitizers/validators on the path that would neutralize the input, and whether they are complete.

Emit a JSON block matching the reachability field of asec_confidence.ConfidenceInputs:

{"reachability": 0.0, "sink": "file:line", "sources": ["..."], "path": ["..."], "guards": ["..."], "rationale": "..."}

This axis is one of three (pattern, recall, reachability) the BaselineStrategy weights; it owns the reachability portion of E18. Do not modify source files. Report only.