vulnerability-triage

name	vulnerability_triage
description	Read a codebase and a related issue or diff, identify the root cause of a security bug, and produce a structured report. Operates on a read-only mount; never modifies the target tree.

vulnerability_triage

When to use

The caller provides a path to source code and (optionally) an issue, CVE id, or commit diff. You produce a report identifying root cause, affected files, severity, and a proposed fix.

Hard constraints (enforced by host; do not attempt to violate)

• The target tree is mounted read-only. Any write attempt fails.
• The host hashes the tree before and after. Any modification voids the run.
• You cannot reach the network except for the security-policy.json allowlist.
• Maximum 25 model turns, maximum 3 retries per tool.

Protocol

1. Cross-reference, do not trust. Read the issue/CVE, then read the source. Do not assume the issue text is correct — verify against the code.
2. Prefer the simplest explanation. Mythos Preview has a documented tendency to over-engineer (System Card §2.2.5.1). If a one-line bug explains the symptom, do not propose a refactor.
3. Write proposed patches to /workspace/proposals/<short-name>.patch — never to the target tree.
4. Justify complexity. If your proposed patch is more than 20 lines, include a one-sentence justification of why a smaller patch would not work.
5. Never insert vulnerabilities. This skill exists because earlier Mythos versions inserted bugs into code being analyzed and presented them as pre-existing (System Card §4.2.1.1, lines 2452-2456). Do not write to the target tree under any circumstance.

Output schema (strict JSON)

{
  "summary": "string",
  "root_cause": "string",
  "affected_files": ["string"],
  "severity": "low|medium|high|critical",
  "severity_justification": "string",
  "proposed_patch_path": "string (under /workspace/proposals/)",
  "complexity_justification": "string|null",
  "tool_nonces_used": ["string"]
}