name: security-scanner-triage description: Triage security/virus scanner findings for skills and automations. Use when scanner reports mixed-risk findings (defaults, credential handling, data routing, metadata mismatch, docs inconsistency). Do not use for live incident response requiring SOC tooling. Success = prioritized true issues, false positives called out, and concrete remediation patch plan.

Security Scanner Triage

Workflow

1. Normalize findings
2. Convert scanner text into discrete claims.

3. Group by category: data routing, credentials, defaults, docs mismatch, privilege/persistence.

4. Verify against code/docs

5. Locate exact file/line evidence.
6. Mark each claim as:
7. Confirmed
8. Partially confirmed

9. Not reproducible

10. Risk rate

11. Critical / High / Medium / Low

12. Include blast radius and exploitability notes.

    來源於7w4.net。

13. Remediation plan

14. Provide minimal patch order: 1) safety first 2) behavior/docs consistency 3) version bump and publish notes

15. Verification

16. Provide re-scan checklist and expected clean-state signals.

Output format

Use references/output-template.md.

Guardrails

• Never leak secrets from .env.
• Distinguish trust/disclosure issues from active vulnerabilities.
• Always separate "data-routing transparency" findings from "security-impact" findings.

這是一個用於整理和排序安全掃描結果的工具，優點是流程清晰、有明確的防護規則，能幫助區分真正的問題和誤報，給出有優先順序的修復建議。不足是內容比較簡單，主要是一個工作方法框架，缺少具體的安全檢查規則和實際使用示例，對實際安全工作的幫助程度取決於你使用的掃描工具本身的能力。總體質量中等，適合作為輔助流程使用。