Lead triage
Turn an observation into a ranked, evidence-aware hypothesis with one clear test that could prove or reject it.
This is the complete downloadable file. Open plain text ↗
---
name: lead-triage
description: "Turn an observation into a ranked, evidence-aware hypothesis with one clear test that could prove or reject it."
---
# Lead triage
Turn an observation into a ranked, evidence-aware hypothesis with one clear test that could prove or reject it.
Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.
## Bring to the review
- Observed behavior and stable record references
- Applicable scope and safety limits
- A candidate decisive test
## Review guide
### 1. Name the observation
Record what was directly seen without assigning impact. Link existing assets, checks, timestamps, and evidence references with search_hunt_records.
### 2. State the hypothesis
When a local Hunt Workbench is available, call upsert_lead with supporting observations, possible impact, missing proof, rank, and the next decisive test. A lead is not a validated finding.
### 3. Plan one discriminator
Use record_check to preserve the planned test and its limits. Use next_actions when several gaps compete; it should rank work, not convert a hypothesis into fact.
## MCP calls
Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.
Durable records in the selected local workspace: `upsert_lead`, `record_check`, `next_actions`, `search_hunt_records`.
Keep private evidence and scope records in the local workspace.
## What to produce
- Ranked lead with stable ID
- Observation and hypothesis kept separate
- One authorized decisive test
## Common mistakes
- Writing impact as observed fact
- Treating a technology fingerprint as proof
- Planning broad retesting instead of a discriminator
## Reading and source context
### Resources
- [OWASP Threat Modeling: system assumptions and mitigation validation](https://vulns.co/research/resources/owasp-threat-modeling-assumptions-and-validation/)
- [Quality Reports](https://vulns.co/research/resources/hackerone-quality-vulnerability-reports/)
### Diagrams
- [Approval stays attached to the reviewed version](https://vulns.co/research/diagrams/approval-version-integrity/)
### Reports
- [Cloud Build approval was not bound to immutable code](https://vulns.co/research/reports/google-cloud-build-approval-toctou-2025/)
- [GitHub Actions trust depended on invalid repository references](https://vulns.co/research/reports/github-actions-reference-validation-2021/)
## Provenance
Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.
Reader: https://vulns.co/skills/lead-triage/
The review
What to look for
Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.
Name the observation
Record what was directly seen without assigning impact. Link existing assets, checks, timestamps, and evidence references with search_hunt_records.
State the hypothesis
When a local Hunt Workbench is available, call upsert_lead with supporting observations, possible impact, missing proof, rank, and the next decisive test. A lead is not a validated finding.
Plan one discriminator
Use record_check to preserve the planned test and its limits. Use next_actions when several gaps compete; it should rank work, not convert a hypothesis into fact.
What to produce
- Ranked lead with stable ID
- Observation and hypothesis kept separate
- One authorized decisive test
Common mistakes
- Writing impact as observed fact
- Treating a technology fingerprint as proof
- Planning broad retesting instead of a discriminator
Use with MCP
Take this into the workbench.
The hosted MCP reads public research. The separate local Hunt Workbench saves private project records in your chosen directory.
Public context
get_research_context search_research get_research_record
Local record tools
upsert_lead record_check next_actions search_hunt_records
Continue the study
Reading & source context
Editorial notes above connect these references. Open each record for its original source and review date.
Visual models
Connected disclosures
From the field toolkit
Guide by GK Data · Research snapshot 2026-10-04.
Sources and review dates are preserved in the library provenance.