Sec Triage Agent — Security skill for Claude Code

Sec-Triage-Agent: Autonomous Security Triage

Sec-Triage-Agent is an autonomous security orchestration tool designed to automate the initial triage of vulnerability findings from SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) tools. By leveraging Large Language Models (LLMs), the agent reduces the manual effort required by security engineers to filter false positives and initiate remediation workflows.

🚀 Features

• LLM-Powered Analysis: Uses a local or remote LLM (via Ollama) to analyze vulnerability reports and decide on the appropriate triage action.
• Structured Triage Output: Employs Pydantic to ensure decisions are consistent and machine-readable.
• Automated Remediation: Integrates with Git to automatically create remediation branches and propose code fixes for low-risk findings.
• Critical Escalation: Automates the creation of high-priority tickets in SIEM/Jira for critical vulnerabilities.
• Real-time Alerting: Sends immediate notifications to security channels via Slack for escalated findings.
• Deterministic Fallback: Includes a rule-based engine to ensure service continuity if the LLM is unavailable.

🏗️ Architecture

The agent operates as a pipeline: `Security Report (JSON)` $\rightarrow$ `Ollama LLM (Analysis)` $\rightarrow$ `Decision Engine` $\rightarrow$ `Tool Execution`

Decision Matrix

Action	Condition	Resulting Tool Execution
AUTO_FIX	Hardcoded secrets / common patterns	Git Branch + Patch Suggestion
ESCALATE	Infrastructure CVEs / Critical risk	Jira Ticket + Slack Notification
REJECT	False positives (e.g., test files)	Marked as False Positive

📋 Prerequisites

• Python 3.10+
• Ollama: Installed and running locally (or accessible via OLLAMA_BASE_URL).
• LLM Model: qwen2.5-coder:1.5b (default) or other compatible models like llama3.1.

⚙️ Setup Instructions

1. **Clone the repos