prioritize-redflags

Ranks journal findings by severity, profile weight, and regression status for reporting.

2|Updated Jun 14, 2026
One-click install
npx skills add https://github.com/odysseyalive/claude-watchman --skill prioritize-redflags-odysseyalive
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: prioritize-redflags
Source: https://github.com/odysseyalive/claude-watchman/tree/main/skills/logic/prioritize-redflags
Command: npx skills add https://github.com/odysseyalive/claude-watchman --skill prioritize-redflags-odysseyalive

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Raw severity scores alone do not reflect what actually matters on a given machine: the same finding ranks differently on a public server than on a workstation, and a regression deserves more attention than a long-standing known issue. This Skill orders the findings journal so the report leads with what matters on this specific host. ## Core Features & Use Cases - Context-aware scoring: Scores each open or regressed finding using base severity, profile weight via profile_severity, status, category, and exposure (public server vs workstation). - Severity normalization: Updates a finding's severity in the SQLite journal when the machine profile assigns it a different weight than the default, keeping reports and thresholds consistent. - Regression boost: Elevates regressed findings, since a fix that came back is urgent. - Use Case: After correlate-findings computes the delta on a public web server, run this Skill so report-status and send-report lead with the regressed SSH hardening finding instead of a stale low-risk notice. ## Quick Start Ask the AI to run the prioritize-redflags skill after correlate-findings to rank the journal findings by what matters most on this machine before generating the report.

Frequently Asked Questions about prioritize-redflags

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prioritize security findings on a Linux server?▼

Score each open or regressed finding using its base severity, the machine profile's severity weight, its status, category, and exposure. A security finding on a public-facing server outranks the same finding on a workstation, and regressions get a boost.

How does regression detection affect finding priority?▼

A finding with regressed status receives a scoring boost because a fix that came back is urgent. Regressions outrank long-standing known issues so the report leads with them.

When should I run prioritize-redflags in the monitoring loop?▼

Run it after correlate-findings has computed the delta and before report-status or send-report consumes the ranking. It depends on the journal already containing scored findings.

Can severity scores differ between a server and a workstation?▼

Yes. The profile_severity function can assign a check a different weight than its default based on the machine profile, and the finding's stored severity is updated in the journal so reports and thresholds agree.

Can I lower a finding's risk tier to make a fix easier?▼

No. The skill explicitly forbids reclassifying a finding's risk_tier downward to simplify remediation. The risk tier is a safety boundary, not a priority knob.