New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Triage

by Encod3d-Sec in Encod3d-Sec/TORCH

Finding validation gate - 7-Question triage adapted for FIND schema.

MITAuto-check passedSecurity

Install Triage

skills CLI
$ npx skills add Encod3d-Sec/TORCH --skill triage -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install Encod3d-Sec/TORCH triage --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/workflow/triage .claude/skills/triage && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
triage
GitHub stars
329
Token cost
~848 tokens
SKILL.md length
375 words
Files
1
Skills in repo
35
Repo updated
First seen
Licence
MIT

At a glance

Finding validation gate - 7-Question triage adapted for FIND schema.

  • Works in 4 steps: Have you validated the FULL chain to… → What does the attacker walk away with in… → Have you reproduced the full chain… → …
  • Security work in your project
  • SKILL.md covers THE 7-QUESTION GATE, Pre-Severity Gate (run before… and Decision
  • Calls python3

What it does

Triage is an agent skill from Encod3d-Sec/TORCH. Finding validation gate - 7-Question triage adapted for FIND schema. Run before moving any FIND from Research to Completed. One NO = keep in Research. All YES = move to Completed, then run /evidence.

Its SKILL.md is about 850 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security. The repository describes itself as: Karpathy LLM based claude harness for PenetrationTesting / Bugbounty using obsidian. The licence is MIT.

When your agent uses it

  • Security work in your project

Example prompts

  • “/triage”

Requirements

  • Python 3

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Have you validated the FULL chain to attacker-attainable impact, or only one primitive?
  2. What does the attacker walk away with in one concrete sentence?
  3. Have you reproduced the full chain end-to-end at least twice?
  4. Is there a validation step (signature check, audience check, MFA) still gating the chain?

What it can do on your machine

Read from SKILL.md and the folder at commit d21b6c9. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Triage loads about 848 tokens when it runs. Until then it costs about 52 tokens; SKILL.md has 375 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~52
When it runs · the whole SKILL.md, loaded when a task matches
~848

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Encod3d-Sec/TORCH at commit d21b6c9, republished under its MIT licence (© Encod3d-Sec). 375 words, ~848 tokens.

Download SKILL.mdSave it as .claude/skills/triage/SKILL.md (or your agent's skills folder).
name
triage
description
Finding validation gate - 7-Question triage adapted for FIND schema. Run before moving any FIND from Research to Completed. One NO = keep in Research. All YES = move to Completed, then run /evidence.

Triage: Finding Validation Gate

Use BEFORE moving any FIND from Vulns/Research/ to Vulns/Completed/.

One wrong answer = keep the finding in Research. Move on to next test class.

THE 7-QUESTION GATE

Ask in order. One NO = STOP for this finding.

Q1: Can an attacker use this RIGHT NOW, step by step?

Complete this template:

Setup:   I need [own account / another user's ID / no account / internal access]
Request: [exact HTTP method, URL, headers, body -- copy-paste ready]
Result:  I can [read / modify / delete / execute] [exact data or action]
Impact:  The real-world consequence is [specific impact]

If you CANNOT write the Request line as a real reproducing command -> keep in Research.

Q2: Is the impact within engagement scope?
  • Does it affect an in-scope asset?
  • Does the impact match the severity level being claimed?
  • Not a third-party service the target merely uses?
Q3: Is the root cause in an in-scope asset?
  • Production asset (not staging/dev unless in scope)
  • Not out-of-scope subsidiary or third-party
Q4: Does it require privileged access that an attacker cannot realistically obtain?
  • "Admin can do X" = not a finding
  • "Non-admin can do X that only admin should do" = valid
  • Pre-auth or low-auth is highest value
Q5: Is this already known or documented?
  • Check Vuln-index.md - not already listed?
  • Check Deadends.md - not already investigated and closed?
  • Not design-documented behaviour?
Q6: Can you prove impact beyond "technically possible"?
  • XSS -> show actual session theft or action execution, not just alert(1)
  • SSRF -> confirm OOB callback (DNS/HTTP), not just URL echo in error message
  • SQLi -> show actual data extracted from a real table
  • IDOR -> show actual other-user data in response body, not just 200 status
Show full SKILL.md (147 more words)Show less
Q7: Not on the Never-Promote list?

Never promote to Completed without a chain:

Self-XSS only (no CSRF trigger)
Open redirect alone (no OAuth/ATO chain)
CORS wildcard without credentialed exfil PoC
SSRF DNS-only (no internal service access)
Rate limit without demonstrated impact
Version banner alone
Missing headers alone (no impact PoC)

Pre-Severity Gate (run before labelling CRITICAL or HIGH)

  1. Have you validated the FULL chain to attacker-attainable impact, or only one primitive?
  2. What does the attacker walk away with in one concrete sentence?
  3. Have you reproduced the full chain end-to-end at least twice?
  4. Is there a validation step (signature check, audience check, MFA) still gating the chain?

A "primitive confirmed" != exploitable. Downgrade until the gate is bypassed.

Decision

ResultAction
All 7 YES + Pre-Severity Gate cleanMove FIND to Vulns/Completed/. Update status in Vuln-index.md. Run python3 scripts/find-lint.py and fix any gaps (Description/PoC/Impact/Remediation + CVSS for HIGH/CRITICAL) so it is report-ready. Then run /evidence.
Any NOKeep in Vulns/Research/. Update status to PARTIAL (reason) in Vuln-index.md. Document what is missing.
Q7 chain requiredMove to Vulns/Research/ with note "chain required: [what is needed]".

© Encod3d-Sec, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/workflow/triage of Encod3d-Sec/TORCH.

Open the folder on GitHubat commit d21b6c9

Compare with similar skills

Triage next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Triage compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Triage this skillEncod3d-Sec/TORCH329—~848Automated safety check: PassMIT
Fla Ascend Performancefla-org/flash-linear-attention5.8k—~6.3kAutomated safety check: PassMIT
Deepsec Documentation Guidevercel-labs/deepsec8.1k—~956Automated safety check: PassApache-2.0
Skill Scannergetsentry/skills1k4 repos~2.5kAutomated safety check: WarnApache-2.0
Serenity Aleabitoreddityan-labs/serenity-aleabitoreddit4811 repos~3.3kAutomated safety check: PassNone
Security Alert Triageelastic/agent-skills5921 repos~3.5kAutomated safety check: NotesApache-2.0

Similar skills

  • Fla Ascend Performance

    fla-org/flash-linear-attention

    Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.

    5.8k GitHub stars~6.3k tokensUpdated today
    SecurityAuto-check passed

  • Deepsec Documentation Guide

    vercel-labs/deepsec

    Official

    Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.

    8.1k GitHub stars~956 tokensUpdated 10 days ago
    SecurityAuto-check passed

  • Skill Scanner

    getsentry/skills

    Official

    Scan agent skills for security issues. An agent skill from getsentry/skills.

    1k GitHub starsUsed in 4 repos~2.5k tokens
    SecurityAuto-check: warnings

  • Serenity Aleabitoreddit

    yan-labs/serenity-aleabitoreddit

    Apply trader Serenity's (@aleabitoreddit) AI/semiconductor supply-chain analytical lens to US-stock ideas and market judgment.

    481 GitHub starsUsed in 1 repo~3.3k tokens
    SecurityAuto-check passed

  • Security Alert Triage

    elastic/agent-skills

    Official

    Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.

    592 GitHub starsUsed in 1 repo~3.5k tokens
    SecurityAuto-check: notes

  • Shiro Attack CLI

    SummerSec/ShiroAttack2

    当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…

    2.6k GitHub stars~945 tokensUpdated 4 mo ago
    SecurityAuto-check passed

More from Encod3d-Sec/TORCH

All 35 skills in this repo

  • Bug Bounty Campaign Driver

    Encod3d-Sec/TORCH

    Runs a bug-bounty engagement through a script that tracks the current pass, builds a board of rows from recon and prints the next required action each turn.

    329 GitHub stars~1.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Campaign Workflow Health Check

    Encod3d-Sec/TORCH

    Checks that the bb, pt and ctf workflow driver is set up correctly on a machine: vault content, skill symlinks, hooks, imports and a live smoke test, with fixes for failures.

    329 GitHub stars~611 tokensUpdated 1 mo ago
    Auto-check passed

  • Visible Browser for Manual Login Capture

    Encod3d-Sec/TORCH

    Opens a visible Chromium window on a Kali VM so an operator can complete a manual login or CAPTCHA while the agent watches and acts through the chrome-devtools MCP.

    329 GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • CTF Campaign Driver

    Encod3d-Sec/TORCH

    Runs a capture-the-flag box from first scan to root with a driver script that tracks progress and prints the next action each turn.

    329 GitHub stars~1.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Sub-Agent Exploit-Run Delegation

    Encod3d-Sec/TORCH

    Decides when a main pentesting agent should hand a fully-specified, mechanical exploit-compile or privilege-escalation step to a cheaper sub-agent, and how to specify that handoff safely.

    329 GitHub stars~1.6k tokensUpdated 1 mo ago
    Auto-check: notes

  • Adaptive Web Fuzzing

    Encod3d-Sec/TORCH

    Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

    329 GitHub stars~1.3k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Triage

What does Triage do?

Finding validation gate - 7-Question triage adapted for FIND schema. Triage is an agent skill from Encod3d-Sec/TORCH. Finding validation gate - 7-Question triage adapted for FIND schema.

When should I use Triage?

Triage fits situations like: security work in your project.

How do I install Triage in Claude Code?

Run `npx skills add Encod3d-Sec/TORCH --skill triage -a claude-code`. Or copy the skill folder (skills/workflow/triage in Encod3d-Sec/TORCH) into .claude/skills/triage in your project. Claude Code loads it when a task matches its description.

How do I install Triage in Codex?

Run `npx skills add Encod3d-Sec/TORCH --skill triage -a codex`. Or copy the skill folder (skills/workflow/triage in Encod3d-Sec/TORCH) into .agents/skills/triage in your project. Codex loads it when a task matches its description.

Can I use Triage in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Encod3d-Sec/TORCH --skill triage -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/triage, .gemini/skills/triage, .github/skills/triage and .opencode/skills/triage in your project.

What does Triage need to run?

Going by SKILL.md and its folder, Triage needs the command-line tools its instructions call (python3). Our summary lists: Python 3.

Does Triage access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Triage safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Triage use?

Triage is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Triage use?

About 848 tokens (SKILL.md is roughly 3.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Triage?

Skills that share tags, products or a category with Triage: Fla Ascend Performance (fla-org/flash-linear-attention, 5.8k stars), Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Skill Scanner (getsentry/skills, 1k stars) and Serenity Aleabitoreddit (yan-labs/serenity-aleabitoreddit, 481 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Triage?

Encod3d-Sec (a GitHub user) maintains it in Encod3d-Sec/TORCH, which has 329 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on September 1, 2026.

Source: Encod3d-Sec/TORCH on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.