菜单
Triage a candidate finding by deciding whether the vulnerable code is reachable from an untrusted entry point, producing the reachability axis (0-1) that feeds asec-confidence. Use when the user asks to triage a finding or assess exploitability.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Big-Sleep variant analysis. Given a recently-fixed bug shape (the lines added/removed in a patch), find more code in the repository that has the same shape and is likely to carry the same defect. Reports variants linked to their seed. Deny-by-default: only the allowed_tools below are permitted.
Review a code diff or corpus for security vulnerabilities grounded in the supplied threat model. Reads code semantically, forms hypotheses, verifies them, and emits scored findings as a single JSON code block. Deny-by-default: only the allowed_tools below are permitted.
Given an architecture description or diagram, produce a STRIDE threat model plus attack trees as YAML. Use when the user asks to threat model a system.
Review a git diff for vulnerabilities by running Semgrep and CodeQL, then emit structured findings. Use when the user asks for a security review of a diff/PR.
Given an architecture description, diagram, or repo, produce a Phase-Zero STRIDE threat model plus attack trees as YAML conforming to asec-threat-model schema. Use when the user asks to bootstrap or create a threat model for a system.
Critique an existing threat model for completeness and rigor — missing STRIDE categories, unjustified skips, weak mitigations, ungrounded likelihood/impact. Use when the user asks to review, critique, or red-team a threat-model.yaml.
| name | reachability-triage |
| description | Triage a candidate finding by deciding whether the vulnerable code is reachable from an untrusted entry point, producing the reachability axis (0-1) that feeds asec-confidence. Use when the user asks to triage a finding or assess exploitability. |
| allowed-tools | Read Grep Glob Bash(git diff *) Bash(semgrep *) |
| argument-hint | ["finding-file-or-location"] |
| context | fork |
| agent | general-purpose |
@$ARGUMENTS[0]
semgrep taint
queries when available). Record the shortest concrete path or prove none exists.1.0 — direct, unconditional path from an untrusted source to the sink.0.6-0.9 — reachable but guarded (auth, validation, feature flag); note the guard.0.1-0.5 — reachable only via an unlikely or internal-only path.0.0 — no path from any untrusted source (dead code, test-only, fully gated).Emit a JSON block matching the reachability field of asec_confidence.ConfidenceInputs:
{"reachability": 0.0, "sink": "file:line", "sources": ["..."], "path": ["..."], "guards": ["..."], "rationale": "..."}
This axis is one of three (pattern, recall, reachability) the BaselineStrategy weights;
it owns the reachability portion of E18. Do not modify source files. Report only.