skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-web-application-vulnerability-triage

Triage DAST and SAST scan findings using OWASP risk rating to prioritize remediation.

4|Updated Apr 28, 2026
Search Tags:#owasp#sast#risk rating#dast#burp suite#false positive#vulnerability triage
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-web-application-vulnerability-triage-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-web-application-vulnerability-triage
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-web-application-vulnerability-triage
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-web-application-vulnerability-triage-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Security teams are overwhelmed by noisy DAST and SAST scanner output, mixing true vulnerabilities with false positives and lacking consistent risk prioritization. This Skill validates findings, deduplicates results, applies the OWASP Risk Rating Methodology, and assigns SLA-driven remediation deadlines. ## Core Features & Use Cases - Finding Validation: Classify scanner results as true positive, false positive, or needs-review using evidence and confidence indicators. - OWASP Risk Scoring: Calculate likelihood and impact scores across threat agent, vulnerability, technical, and business factors to produce Critical through Note risk levels. - Automated Triage Pipeline: Ingest ZAP, Burp Suite, and Nikto JSON reports, deduplicate by title/URL/parameter, and generate prioritized reports with SLA deadlines. - Use Case: After a weekly ZAP scan of a customer-facing application, run the triage agent to filter informational noise, score confirmed SQL injection findings as Critical with a 7-day SLA, and push validated results to DefectDojo. ## Quick Start Triage the findings in zap_results.json using the web application vulnerability triage skill and generate a prioritized report with SLA deadlines.

Frequently Asked Questions about performing-web-application-vulnerability-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage DAST scan results from OWASP ZAP or Burp Suite?▼

Import the scanner JSON output, map CWE identifiers to OWASP Top 10 categories, filter known false positive patterns like missing informational headers, and flag confirmed exploitation evidence as true positives. Remaining findings go to manual validation in Burp or ZAP before risk rating.

How does the OWASP Risk Rating Methodology calculate vulnerability risk?▼

Risk equals Likelihood multiplied by Impact, each scored 0-9 across eight factors. Likelihood covers threat agent skill, motive, opportunity, and ease of exploit; impact covers confidentiality, integrity, availability, and business factors like financial and compliance damage.

What SLA deadlines apply to vulnerability severity levels?▼

Critical findings (CVSS 9.0-10.0) get 7 days, High (7.0-8.9) gets 30 days, Medium (4.0-6.9) gets 90 days, Low (0.1-3.9) gets 180 days, and Informational findings get 365 days for remediation.

Can I combine SAST and DAST findings in one triage report?▼

Yes, the combined workflow imports both SAST and DAST results, correlates code-level findings with runtime findings, and elevates priority for vulnerabilities confirmed by both sources. Duplicates pointing to the same root cause are merged into a unified report.

Why are some scanner findings marked as false positives automatically?▼

Common informational findings like missing Content-Security-Policy or X-Content-Type-Options headers at info or low severity match known false positive patterns and are auto-dismissed. SAST injection findings always require manual code review instead of automatic classification.

Related Skills

Explore More Software Engineering Skills→
HouseGarofaloHouseGarofalo
3

security-scanner

Scan container images, dependencies, and IaC for security vulnerabilities.

Official
Advanced
jaskaranhundaljaskaranhundal
3

findings-tracker

Manage security finding lifecycles with risk scores and SLA enforcement.

Community
Advanced
balsm-healthbalsm-health
2

exploiting-sql-injection-vulnerabilities

Detect and exploit SQL injection vulnerabilities in web applications during penetration tests.

Official
Advanced
starwreckntxstarwreckntx

Vulnerability Management Agent

Track vulnerabilities across assets using CVE/CVSS standards and CVSS scoring.

Community
Basic