Name: testland/multi-tool-finding-triage
Rating: 69.6 (1 reviews)
Author: testland

testland/multi-tool-finding-triage

Merges two or more security scanner reports into one gate. Use when you need a single BLOCK or PASS decision from multiple scanners instead of reading N separate reports. Normalizes each report into one common finding format (a canonical `Finding`), deduplicates on a per-domain key while recording which scanners agree (`caught_by` consensus), validates a waiver (finding-suppression) file, rejecting any missing `expires:` / `approved_by:` / `reason:` or expired, enriches CVE findings with EPSS (exploit-probability) and CISA KEV (known-exploited catalog), then applies a `fail_on` severity threshold to emit BLOCK or PASS plus a bucketed pull-request comment. Works across static (SAST), dynamic (DAST), secret, dependency (SCA), container, and IaC scanners. To run a single scanner instead use semgrep-rules, codeql-queries, or one of the language-native-sast linters; this runs after them to merge output - the cross-scanner gate, not a single-scanner wrapper.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, executable triage pipeline with strong progressive disclosure and clear validation checkpoints. The recurring gap is minor: a little motivational/redundant prose and a couple of core logic pieces (verdict function, feed-failure handling) deferred to references rather than inline.

Suggestions

Trim the Overview's motivational framing and avoid duplicating the full PR-comment markdown in both Step 7 and the Worked example to tighten conciseness.

Inline the verdict function (currently only in references/cve-enrichment.md) since the BLOCK/PASS gate is the skill's core output, so readers need not open a reference to see the final step.

Add explicit failure handling for the EPSS/KEV feed fetch in Step 4 (behavior on download failure or stale feed) to close the validation gap in enrichment.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with real Python and a tight pipeline, but the Overview's motivational framing ('Reviewers read N reports, miss that two tools flagged the same line, and rubber-stamp the pull request') and a near-duplicated full PR-comment between Step 7 and the Worked example are trimmable, so it is just below the lean anchor 5.	4 / 5
Actionability	Provides executable dedupe/priority/validate_waiver functions and a runnable CI YAML, but the core verdict function and the per-domain key_fn table are referenced out rather than inline, leaving minor gaps versus the fully copy-paste anchor 5.	4 / 5
Workflow Clarity	A clear 7-step sequence with explicit validation (Step 1 halts on NO_SCANNER_OUTPUT/missing artifacts, Step 5 rejects and reports bad waivers, a re-run feedback loop), but minor gaps remain — no inline handling for EPSS/KEV feed fetch failure in Step 4 and the gate's verdict logic lives in a reference — keeping it just below anchor 5.	4 / 5
Progressive Disclosure	A clear overview with three real, well-signaled one-level-deep references (finding-normalization.md, cve-enrichment.md, waiver-schema.md), content appropriately split between inline pipeline and detail files, matching the anchor 5 example.	5 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, highly specific description that clearly states both capability and trigger conditions and explicitly differentiates from adjacent single-scanner skills. The only mild gap is trigger-term breadth (no synonyms or file extensions), keeping trigger quality at 4 rather than 5.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (merges reports into one gate, normalizes to a canonical Finding, deduplicates on a per-domain key, validates waivers rejecting missing/expired fields, enriches CVEs with EPSS and CISA KEV, applies a fail_on threshold) — comprehensive coverage matching the anchor 5 example.	5 / 5
Completeness	Explicitly answers what (merge/normalize/dedupe/enrich/waive/gate) and when ('Use when you need a single BLOCK or PASS decision from multiple scanners instead of reading N separate reports'), plus negative trigger guidance for single-scanner cases.	5 / 5
Trigger Term Quality	Good natural-term coverage ('security scanner reports', 'multiple scanners', 'BLOCK or PASS', 'pull-request comment', SAST/DAST/SCA/IaC/container/secret), but missing common synonyms like 'vulnerability'/'triage' and any file extensions (sarif/json), so it sits just below the comprehensive anchor 5.	4 / 5
Distinctiveness Conflict Risk	Carves a clear cross-scanner-gate niche and explicitly disambiguates from sibling single-scanner skills ('this runs after them to merge output - the cross-scanner gate, not a single-scanner wrapper'), minimizing conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
referenced_paths_exist	Referenced path issues: 1 missing	Warning

	Total	15 / 16 Passed

Reviewed

19 days ago

Table of Contents

Discovery Implementation Validation