{
  "slug": "lead-triage",
  "name": "Lead triage",
  "category": "Research",
  "summary": "Turn an observation into a ranked, evidence-aware hypothesis with one clear test that could prove or reject it.",
  "scope": "Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.",
  "inputs": [
    "Observed behavior and stable record references",
    "Applicable scope and safety limits",
    "A candidate decisive test"
  ],
  "review": [
    {
      "title": "Name the observation",
      "body": "Record what was directly seen without assigning impact. Link existing assets, checks, timestamps, and evidence references with search_hunt_records."
    },
    {
      "title": "State the hypothesis",
      "body": "When a local Hunt Workbench is available, call upsert_lead with supporting observations, possible impact, missing proof, rank, and the next decisive test. A lead is not a validated finding."
    },
    {
      "title": "Plan one discriminator",
      "body": "Use record_check to preserve the planned test and its limits. Use next_actions when several gaps compete; it should rank work, not convert a hypothesis into fact."
    }
  ],
  "outputs": [
    "Ranked lead with stable ID",
    "Observation and hypothesis kept separate",
    "One authorized decisive test"
  ],
  "pitfalls": [
    "Writing impact as observed fact",
    "Treating a technology fingerprint as proof",
    "Planning broad retesting instead of a discriminator"
  ],
  "mcp": {
    "hosted": [
      "get_research_context",
      "search_research",
      "get_research_record"
    ],
    "workbench": [
      "upsert_lead",
      "record_check",
      "next_actions",
      "search_hunt_records"
    ]
  },
  "references": {
    "resources": [
      {
        "id": "owasp-threat-modeling-assumptions-and-validation",
        "title": "OWASP Threat Modeling: system assumptions and mitigation validation",
        "url": "https://vulns.co/research/resources/owasp-threat-modeling-assumptions-and-validation/"
      },
      {
        "id": "hackerone-quality-vulnerability-reports",
        "title": "Quality Reports",
        "url": "https://vulns.co/research/resources/hackerone-quality-vulnerability-reports/"
      }
    ],
    "diagrams": [
      {
        "id": "approval-version-integrity",
        "title": "Approval stays attached to the reviewed version",
        "url": "https://vulns.co/research/diagrams/approval-version-integrity/"
      }
    ],
    "reports": [
      {
        "id": "google-cloud-build-approval-toctou-2025",
        "title": "Cloud Build approval was not bound to immutable code",
        "url": "https://vulns.co/research/reports/google-cloud-build-approval-toctou-2025/"
      },
      {
        "id": "github-actions-reference-validation-2021",
        "title": "GitHub Actions trust depended on invalid repository references",
        "url": "https://vulns.co/research/reports/github-actions-reference-validation-2021/"
      }
    ]
  },
  "provenance": {
    "publisher": "vulns.co / GK Data",
    "guide_updated": "2026-10-12",
    "library_as_of": "2026-10-04",
    "library_commit": "d5550c7891119cf1379e235721541c947850a3b3"
  },
  "url": "https://vulns.co/skills/lead-triage/",
  "markdown_url": "https://vulns.co/skills/lead-triage/SKILL.md"
}