triage-vuln

name	triage-vuln
description	List and explain findings from a scan with data flow. Invoke when the user runs /triage-vuln or says triage, review findings, or investigate finding ids after a scan. Do NOT satisfy triage by calling sl_* tools without this skill active; run /triage-vuln first.
argument-hint	<app> <scan> [finding-id]

Triage findings

Uses slmcp against the Qwiet API. Requires completed code analysis (/run-security-scan; some hosts may prefix the skill name). If MCP tools are missing, run /setup-harness-code-security-mcp first. MCP setup: mcp-setup.md.

When to run this skill

The user (or you) must invoke /triage-vuln so this file is loaded. Some hosts prefix skills, for example /harness-sast-and-sca:triage-vuln. If the user says "triage", "review findings", or "explain finding X" after a scan without a slash command, invoke this skill (Skill tool or ask them to run the slash command) — do not call sl_get_findings / sl_get_finding_dataflows from memory of the prior scan turn alone.

Inputs

• app — same id used for the scan (workspace folder name or user-provided)
• scan — from sl_analyze.scan_id or sl_list_branch_scans.latest.id
• finding (optional) — API finding id for a single deep-dive (not rank 1/2/3)

Workflow

List findings

sl_list_findings with { "app": "...", "scan": "..." }

• Read counts for severity/category overview
• Use top_actionable for critical/high SAST, SCA, and OSS risk (e.g. malicious packages) — real id values
• If top_actionable is empty, read actionable_query_warnings and counts — do not jump to full: true
• Do not use full: true unless the user explicitly needs the raw API payload

Multiple findings (preferred)

sl_get_findings with { "app": "...", "findings": ["id1", "id2", ...] } (max 10)

Pass ids from top_actionable[].id, not ordinal labels.

Single finding

sl_get_finding with { "app": "...", "finding": "..." } when you only need one.

Data flow

• One finding: sl_get_finding_dataflow with { "app", "finding", "scan" }
• Several: sl_get_finding_dataflows with { "app", "scan", "findings": [...] } (max 5)

Present source → steps → sink from compact nodes when present.

Output

• Ranked short list of findings to fix first (from top_actionable and counts)
• Per deep-dive: impact, location, fix direction

Next step (required handoff)

When triage is complete, tell the user to run /autofix-vuln for remediation (or invoke that skill on a new turn if they ask for autofix). Some hosts prefix skills, for example /harness-sast-and-sca:autofix-vuln.

Pass app and all finding ids from top_actionable[].id (code + OSS) — not ids guessed from an earlier scan summary. AutoFix should request and apply fixes for the full list unless the user asked for a subset.