AI-supported vulnerability triage with the GitHub Security Lab Taskflow Agent

This post explains how GitHub Security Lab uses open-source LLM taskflows (seclab-taskflow-agent and seclab-taskflows) to automate triage of CodeQL alerts by breaking work into explicit, verifiable steps (information collection, auditing, report creation, validation) and leveraging MCP tools plus GitHub Issues to reduce false positives. It showcases examples for GitHub Actions code injection and JS/TS client-side XSS, notes about ~30 real-world vulnerabilities found since August, and offers development tips for building reusable, reliable taskflows.