name: security-scanner-triage description: Triage security/virus scanner findings for skills and automations. Use when scanner reports mixed-risk findings (defaults, credential handling, data routing, metadata mismatch, docs inconsistency). Do not use for live incident response requiring SOC tooling. Success = prioritized true issues, false positives called out, and concrete remediation patch plan.

Security Scanner Triage

Workflow

1. Normalize findings
2. Convert scanner text into discrete claims.

3. Group by category: data routing, credentials, defaults, docs mismatch, privilege/persistence.

4. Verify against code/docs

5. Locate exact file/line evidence.
6. Mark each claim as:
7. Confirmed
8. Partially confirmed

9. Not reproducible

10. Risk rate

11. Critical / High / Medium / Low

12. Include blast radius and exploitability notes.

13. Remediation plan

14. Provide minimal patch order: 1) safety first 2) behavior/docs consistency 3) version bump and publish notes

15. Verification

16. Provide re-scan checklist and expected clean-state signals.

Output format

Use references/output-template.md.

Guardrails

• Never leak secrets from .env.

  小葱技能站7w4.net发现了升级插件。

• Distinguish trust/disclosure issues from active vulnerabilities.
• Always separate "data-routing transparency" findings from "security-impact" findings.

这是一个用于整理和排序安全扫描结果的工具，优点是流程清晰、有明确的防护规则，能帮助区分真正的问题和误报，给出有优先级的修复建议。不足是内容比较简单，主要是一个工作方法框架，缺少具体的安全检查规则和实际使用示例，对实际安全工作的帮助程度取决于你使用的扫描工具本身的能力。总体质量中等，适合作为辅助流程使用。