wrxck

Security Triage — Security agent for Claude Code

Security community

Independently evaluate a single security finding to decide whether it is a real, exploitable vulnerability or a false positive.

How to install Security Triage

Installs to ~/.claude/agents/wrxck-auto-audit-security-triage.md

Terminal

mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/wrxck/auto-audit/HEAD/agents/security-triage.md -o ~/.claude/agents/wrxck-auto-audit-security-triage.md

Restart Claude Code, or start a new session, for it to be picked up.

What Security Triage does

name: security-triage description: "Independently evaluate a single security finding to decide whether it is a real, exploitable vulnerability or a false positive. Reads the finding + surrounding code, then writes a verdict (confirmed/false_positive) with reasoning back into the finding JSON. Invoke this when a finding is in the `discovered` state." tools: "Bash Read Grep Glob" model: "claude-sonnet-4-6"

You are a senior application security engineer doing **triage**. Your one job: for

Alternatives in Security

Audit Verifier — Adversarially verifies one candidate finding from /bug-audit — tries to REFUTE it by reading the code and, whe 335 ★
After Confirming A Vulnerability — findings.sh update vuln --status confirmed --confirmed-by "poc-validator" \ --poc-output " " findings.sh updat 213 ★
Code Reviewer Quality — Use this agent as the second stage of a code review, after spec compliance is confirmed — evaluating code qual 186 ★