agentleFS
yxy050208yxy050208/qwen-security-copilot/skills/triage-report/SKILL.md

triage-report

Skill1 starsChanged 2 months agoMITView on GitHub

使用证据优先的验证门和报告模板整理授权安全评估结果;防止把推测、信息性噪声或越界行为写成漏洞。

1 other project uses a version of this.

Adopted by

Most recently taken up by

The file

Files
SKILL.md

Triage & report(验证与报告)

报告前逐项回答:是否能写出真实且可复核的请求、影响是否在约定范围、资产是否在白名单、前置条件是否现实、是否重复/已知、影响是否已实际证明、是否触发排除条款。任一答案不确定就标记 needs_review,不要夸大严重性。

证据门

  • 结论必须引用脱敏证据或本地证据哈希;AI 摘要不能替代原始证据。
  • 反射、差分和时序结论要有基线与足够样本;仅有 200/403 或版本字符串不算影响证明。
  • 高影响标签需要人工复核与第二次复现;本插件不自动升级为高危,也不自动串联攻击阶段。

生成

调用 report_generate 输出 Markdown 和机器可读 JSON。标题写清资产、问题类别和已证明影响;修复建议具体、短小;同时输出覆盖/未覆盖矩阵、false-positive 说明、时间线和证据哈希。

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.