Installs into .claude/skills of the current project.
Are you the author of Security Triage?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/papadopouloskyriakos-security-triage)
# security-triage
Security scan finding triage — investigates findings from the daily vulnerability scanners.
## Usage
```
./skills/security-triage/security-triage.sh <target_ip> "<finding_title>" <severity> [scanner] [category] [port]
```
## Parameters
| Param | Required | Description |
|-------|----------|-------------|
| target_ip | Yes | Public IP that was scanned |
| finding_title | Yes | Short finding identifier (CVE-ID, "New open port", etc.) |
| severity | Yes | critical, high, medium |
| scanner | No | nlsec01 or grsec01 (auto-detected from target IP) |
| category | No | cve, port, tls, header, exposure (default: unknown) |
| port | No | Affected port number |
## What It Does
1. **NetBox lookup** — identifies which host/service maps to the target IP
2. **Baseline check** — verifies if finding is new vs already-known
3. **Scan context** — retrieves latest nmap/nuclei data from the scanner VM
4. **Quick service check** — for new port findings, identifies the service via nmap
## Scanner Mapping
- `nlsec01` (NL, 10.0.181.X) → scans GR + VPS targets
- `grsec01` (GR, 10.0.X.X) → scans NL + VPS targets
## Escalation
Deep verification (full nuclei re-scan, targeted nmap, testssl) is left to Claude Code (Tier 2).
Claude Code can SSH directly to the scanner VMs for extended investigation.
