In this article
vex-triage
| Field | Value |
|---|---|
| Kind | prompt |
| Source | .github/prompts/security/vex-triage.prompt.md |
| Invocation | Slash command /vex-triage |
| Interactive | Yes |
What it does
Triage CVEs from an existing scan report or SBOM and draft an OpenVEX document, skipping the scan phase - Brought to you by microsoft/hve-core
When to use it
Use this prompt to triage CVEs from an existing supported scan report or SBOM and draft an OpenVEX document without running the scan again. Use vex-scan when current dependency discovery and enrichment are still required.
How to use it
Provide the required report path and optionally the product package URL. The prompt preserves source precedence and drafts status determinations, which require qualified product security review and author-of-record approval before publication.
Example usage
/vex-triage report=reports/sample-sbom.spdx.json product=pkg:npm/@example/sample-api
The prompt triages the fictional SBOM and creates an evidence-linked OpenVEX draft without running a new scan.