Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/briiirussell/cybersecurity-skillsnpx agentmods add rules/briiirussell/cybersecurity-skills/finding-triageWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/briiirussell/cybersecurity-skills/finding-triage)<a href="https://agentmods.dev/rules/briiirussell/cybersecurity-skills/finding-triage"><img src="https://agentmods.dev/badge/rules/briiirussell/cybersecurity-skills/finding-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/briiirussell/cybersecurity-skills/finding-triage"><img src="https://agentmods.dev/badge/rules/briiirussell/cybersecurity-skills/finding-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00156 | $0.05850 |
| Opus 5.5 | $0.00062 | $0.02340 |
| Sonnet 5.5 | $0.00031 | $0.01170 |
| Haiku 4.5 | $0.00016 | $0.00585 |
Grade A, and why
finding-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 438 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Finding Triage — Single-Finding Disposition with Defensible Justification
Every other skill in this repo generates findings. This skill closes the loop — for a single finding, walk through whether it's real, what severity it deserves in your context, and what to do about it. Output is a complete ticket-ready writeup with the right fields, the right justification, and an audit trail that survives a regulator reading it six months later.
A confirmed finding ends in one of five dispositions: Fixed, Deferred, Accepted Risk, Mitigated (platform/config), or Requires major migration. False Positive isn't a disposition for a real finding — it's a determination that there is no finding. A gap with no traced impact ends as a Hardening note: not a finding, no severity.
This skill works on findings from any source: SAST output, DAST scanner, dependency advisory, manual audit, threat-hunt hit, pentest report, vendor disclosure, internal red-team writeup, bug bounty submission — or a structured record from another skill's findings.json.
Cross-references:
vuln-researchfor the technical CVE deep-dive that feeds reachability assessment hereowasp-audit/api-auditdisposition rule (the framework this implements per-finding) and their per-finding verification pass (references/verification.md)scanner-pipelinefor bulk scanner output — triage the survivors here, one at a timesecurity-commsfor translating the disposition writeup into stakeholder-readable language when the finding has to leave the security context- Any audit skill — this consumes their findings as input
- references/severity-calibration.md — the full severity rules this skill summarizes
- references/findings-format.md — the
findings.jsonrecord format
Authorization
Confirm the user owns or is authorized to triage this finding and the system it lives in. Triage reads code, configs and sometimes runs a reproduction — only do that against systems in scope. If a reproduction would touch production or someone else's system, stop and get explicit approval first.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +179 lines · +38 tokens per session c51e0a1c72d9
- 1mo ago First seen · 259 lines · 118 tokens per session scan A 3a1e77ad105f
finding-triage is a cursor rule published in the GitHub repository briiirussell/cybersecurity-skills (435 stars, last pushed today), licensed MIT. It adds 156 tokens to every session and 5,850 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.
no-family-vocabulary-in-framework
The framework domain (packages/1-framework) carries no family- or target-specific vocabulary — types, fields, hooks, or strategy values — and, outside the CLI and the PSL parser's grammar names, no Prisma version name before 8. Enforced by the no-family-vocabulary Biome plugin plus the lint:ratchets ratchet.