testland/multi-tool-finding-triage
Use when several security scanners (SAST, DAST, secrets, SCA, container, IaC) produce separate reports and the team needs one BLOCK or PASS. Normalizes and dedupes findings, records which scanners agree, rejects waivers without expiry or approver, adds EPSS and KEV, and writes one PR comment.
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill executes a curl command to fetch external EPSS and KEV feeds during runtime CI setup from an arbitrary URL, constituting a weak runtime operational dependency.
Where we found it
https://epss.empiricalsecurity.com/epss_scores-current.csv.gz
url · 2 sites
The plugin's CI integration runs curl to fetch the EPSS bulk daily feed from epss.empiricalsecurity.com at runtime without verification (no checksum, no pinned version), constituting an unverifiable external dependency.
SKILL.md
270
curl -sL https://epss.empiricalsecurity.com/epss_scores-current.csv.gz | gunzip > epss.csv
references/cve-enrichment.md
21
curl -sL https://epss.empiricalsecurity.com/epss_scores-current.csv.gz | gunzip > epss.csv
https://api.first.org/data/v1/epss
url · 1 site
The plugin documents using the EPSS per-CVE API from api.first.org as an alternative to the bulk feed, which would be fetched at runtime without verification.
references/cve-enrichment.md
25
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2021-44228"
https://www.cisa.[REDACTED].json
url · 2 sites
The plugin's CI integration runs curl to fetch the CISA KEV feed from cisa.gov at runtime without verification (no checksum, no pinned version), constituting an unverifiable external dependency.
SKILL.md
Line 271
references/cve-enrichment.md
Line 29
- Audited
- Security analysis