triaging-findings

name	triaging-findings
description	Verify raw security findings, dedupe them, rerank exploitability, and assign owners.
argument-hint	<findings-path> [--auto] [--votes N] [--repo PATH] [--fp-rules FILE] [--fresh]
user-invocable	true
allowed-tools	Workflow, Task, Read, Glob, Grep, Write, AskUserQuestion, Bash(git log:*), Bash(rg:*), Bash(grep:*), Bash(find:*), Bash(ls:*), Bash(wc:*), Bash(node .claude/skills/fleet/_shared/scripts/checkpoint.mts:*), Bash(node scripts/fleet/triaging-findings/cli.mts:*)
model	claude-opus-4-8
context	fork
metadata	{"internal":true}

triaging-findings

Adversarial triage of raw security-scanner output. Does four jobs: verify each finding is real, deduplicate across runs and scanners, rank survivors by derived exploitability rather than the scanner's claimed severity, and route each to a component owner. Output is a short, ranked, owned list instead of a raw dump.

Invoke with /fleet:triaging-findings <findings-path> [--auto] [--votes N] [--repo PATH] [--fp-rules FILE].

This is the verification half of the fleet security-scan loop: scanning-vulns (or any external scanner) produces candidates; this skill removes false positives and ranks the rest; patching-findings fixes the survivors.

Arguments (parse from $ARGUMENTS; positional $1/$2 expansion is not stable across runtimes):

• findings path (first positional, required): a JSON file, a directory of JSON files, a VULN-FINDINGS.json, a scanner results directory, or a markdown report.
• --auto: skip the interview and use defaults. Default mode is interactive.
• --votes N: verifier votes per finding (default 3; use 1 for a quick pass, 5 for high-stakes batches).
• --repo PATH: path to the target codebase, read-only (default cwd). Verification needs source access; the skill stops with an error if the cited files aren't reachable.
• --fp-rules FILE: append the contents of FILE to the verifier's exclusion-rule list (Phase 3a). Use for org-specific precedents ("we use Prisma everywhere — raw-query SQLi only", "k8s resource limits cover DoS"). Plain text, one rule per line or paragraph.
• --fresh: ignore any existing checkpoint in ./.triage-state/ and start from Phase 0. Without this flag the skill resumes from the last completed phase.

Do not execute target code. No building, running, installing dependencies, or sending requests. A proof-of-concept that accidentally works against something real is unacceptable, and "couldn't write a working PoC" is weak evidence of non-exploitability. Every conclusion comes from reading source. This applies to the orchestrator and every subagent; include the constraint in every spawn. For high-confidence HIGH findings, recommend a human-built PoC as a follow-up instead.