trailofbits__skills/plugins/vulnerability-triage-brocards/README.md

vulnerability-triage-brocards

Principled framework for triaging vulnerability reports using 7 brocards (rules of thumb) adapted from legal maxims.

Based on William Woodruff's "Brocards for vulnerability triage" (2026).

What It Does

Evaluates incoming CVEs, bug bounty submissions, and security findings against 7 structured criteria to produce an ACCEPT, DISMISS, or NEEDS-MORE-INFO verdict before committing resources to deeper analysis.

The 7 Brocards

1. No Vulnerability Without a Threat Model -- reports must articulate attacker, capability, exploit mechanism, and impact
2. No Exploit from the Heavens -- reject when attacker capabilities already subsume the exploit's impact
3. No Vulnerability Outside of Usage -- theoretical bugs in unreachable code paths are not vulnerabilities
4. No Vulnerability from Standard Behavior -- correct spec compliance is not a vulnerability in the implementation
5. No Vulnerability from Documented Behavior -- explicitly documented behavior with security caveats is not a finding
6. No Cure Worse Than the Disease -- remediation cost must not exceed vulnerability impact
7. The Report Is Neither Necessary nor Sufficient -- CVE numbers and CVSS scores do not substitute for technical evidence

Pipeline Position

This skill sits downstream of agentic vulnerability discovery pipelines and upstream of PoC/exploitability proof and report writeup. Use it as the first gate for incoming reports before investing in deeper analysis.

Skills

Skill	Description
vulnerability-triage-brocards	Structured triage workflow applying all 7 brocards to incoming reports

Installation

Add this plugin to your Claude Code configuration or use:

claude --plugin-dir /path/to/vulnerability-triage-brocards