Finding Tracker

Use this skill as shared state for security findings across the plugin. It helps agents avoid duplicate effort, remember recent milestones, and preserve why a lead became stronger or was debunked.

Default tracker path: data/findings.json in the active target workspace. Keep finding data in the target workspace, not in the skill directory.

States

Every finding must be exactly one of:

• discovered: bug potentially found.
• confident: agent found evidence of the bug plus reachability or exploitability.
• proofed: successful run through the triage-verifier skill. Do not set this state without a verifier reference or result.
• de-escalated: potential bug was debunked at any point.