cve-triage 11.4.0

Download cve-triage.skill, unzip it into ~/.claude/skills/cve-triage (Claude Code) or .agents/skills/cve-triage (Codex), and install scripts/requirements.txt.

What an installer must know. PREPARE now writes evidence/imports.json — a deterministic scan of the repo's own .py files for the matched package's imports — and the emitter requires it on disk, so any triage directory prepared before 11.4.0 must be re-run through prepare_evidence.py --force before it can emit. Two new emitter refusals: a not_reachable verdict shipped as under_investigation or affected, and a person's Human Impact answer recorded on the Phase 3 short-circuit. The import check is one-directional: a live hit the record contradicts is refused; an empty scan proves nothing and licenses nothing.

Built from the first codex/gpt-4.1 fidelity signal (2026-09-14). The design rule the skill is built around — PREPARE → JUDGE → RESOLVE → EMIT: scripts do everything computable, the model judges — is now stated in CLAUDE.md §3.7 and the README. Eval family F14 pins the parso pair to the corrected golden (under_investigation; CVE-2019-12760 is a pickle flaw in parso's grammar cache, and app-hit calls grammar.parse(cache=True)) and passes 2/2 on Sonnet.

Changes since v11.2.1 (the previous tag; 11.3.0 was not separately released):

• docs(evals): F14 measured live at 11.4.0 on Sonnet — PASS 2/2, sound reasoning in both records
• test(evals): F14 verdict fidelity — the parso pair pinned to the corrected golden
• docs(skill): Phase 3 — a deserialization or cache read from disk is an environment trigger, so inconclusive
• feat(skill): PREPARE scans the source tree for the matched package's imports; emit refuses a hits=0 record over a live hit
• feat(skill): 11.4.0 — refuse a not_reachable shipped as under_investigation or affected; Rule 6 enforced on the Phase 3 short-circuit
• docs: the PREPARE → JUDGE → RESOLVE → EMIT design rule — CLAUDE.md §3.7 with the judgement ledger, README spine section
• feat(skill): 11.3.0 — PREPARE pre-seeds _decision.json, moving the mechanical fields off the model

cve-triage 10.3.0

First GitHub Release of the cve-triage skill. Download cve-triage.skill, unzip it into ~/.claude/skills/cve-triage, and install scripts/requirements.txt. Since v9.1.0 this release carries one breaking change (10.0.0: the Human Impact question is outcome-blind and the description was trimmed to fit its limit) — existing users should re-read skill/SKILL.md per the versioning policy.

• feat(skill): 10.3.0 — the judgement file gets a presence contract, and the skip reason stops guessing
• fix(skill): 10.2.0 — scripts resolve on Codex and every Claude install, and the no-profile resolver invocation is back in the body
• fix(skill): 10.1.0 — a trigger the environment supplies is a reason for inconclusive, not a limit to disclose
• test(evals): F13-1 — the needs_review Technical Impact branch gets its first eval
• feat(skill)!: 10.0.0 — the description fits its limit, and the Human Impact question is outcome-blind again
• test(evals): outcome-blindness becomes a suite invariant, not a per-eval annotation
• test(evals): measure the branches the restructure broke, and the rule no script can check
• test(evals): deprecate F1-7 as a wrong measurement, and give the runner a way to say so
• fix(skill): 9.4.0 — the restructure's load-bearing rules restored to the branches that need them
• refactor(skill): 9.2.0 — SKILL.md becomes an entrypoint, the phases move to references/