Individual skill

vuln-triage

Triage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red.

skills/vuln-triage/SKILL.md

Read pinned source

Source commit f7c90bc09ee05dc25cf257bdb1826f2c2552c2cb

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Network or broad shell
Last checked: Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 1,540
Repository last updated: Nov 10, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

product-management Repository topic
productivity Repository topic
skills Repository topic
claude-skills Repository topic
agent-skills Repository topic
chatgpt Repository topic
claude-code Repository topic
cursor Repository topic
gemini Repository topic
prompt-engineering Repository topic
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 3,765 bytes

Read excerpt


# Vulnerability Triage Skill

Scanners cry wolf — most findings aren't as urgent as their color suggests, and a "medium" reachable from the
internet can outrank a "critical" that isn't exploitable in your setup. This skill triages a vulnerability by
**real, contextual risk**: base severity adjusted for exploitability and exposure, with a fix and a
fix-by SLA. For assets you own or are authorized to assess.

## Required Inputs

Ask for these only if they aren't already provided:

- **The finding** — the CVE/scanner/pentest item: what it is, affected component/version, CVSS if given.
- **Your context** — is the affected component reachable (internet-facing? authenticated-only? internal?), what data/privilege it touches, compensating controls in place.
- **Exploit status** — is there a known public exploit / is it being exploited in the wild (e.g. on CISA KEV)?