Security Triage Agent Sample

Runs daily dependency scans, classifies findings into three explicit outcomes (mitigated, auto-fixable, needs human attention), opens fix PRs for the easy ones, and files GitHub issues for everything else with full triage reasoning.

Architecture

Monitored repos and vulnerability feeds (OSV.dev, GitHub Advisory DB) fan into a single triage engine, cross-referenced against your internal security policies via knowledge_search. Every finding leaves the engine through exactly one of three durable outputs.

Triage flow

The three outcomes force a decision per finding — no "I'll come back to it later" in long-term memory where humans can't see it:

• A. Noise — already mitigated, vulnerable function unused, or otherwise no exposure. Decision is stored in long-term memory so future scans don't re-litigate it.
• B. Auto-fix — small targeted fix (typically a patch bump). The agent creates a branch, commits the bump, and opens a PR.
• C. File issue — anything that needs human judgment: major version bumps, multi-file changes, package replacements, or ambiguous risk. The agent files a labeled GitHub issue with full triage reasoning and the recommended action.

Atomic templates

This Solution bundles each custom tool and the substantive routines as standalone library rows alongside the deployable agent — pick the ones you want and reference them from your own AgentTemplate:

Tools (kind: AgentToolTemplate)

• query-osv · query OSV.dev for known CVEs (no auth)
• query-github-advisories · GitHub Advisory DB lookups
• scan-dependencies · parse a lockfile + check every dep against OSV
• get-repo-file · read a file from GitHub
• create-branch / commit-file / create-pull-request · open auto-fix PRs
• create-github-issue · file labeled triage issues
• query-gcloud-logs · pull entries from Cloud Logging

Routines (kind: AgentRoutineTemplate)

• daily-dependency-scan · cron-triggered scan + triage
• hourly-log-analysis · cron-triggered GCP log anomaly check
• pr-review · webhook-triggered PR security review

Each atomic template carries its own setup_actions: block, so installing one standalone surfaces the env vars + installations it depends on without dragging the whole agent's checklist along.

Validate/import

uv run scripts/sample_tool.py pack solutions/security-triage-agent-sample

Upload the generated tarball through the Solution import flow.