vuln-triage
Installation
SKILL.md
Vulnerability Triage Skill
Scanners cry wolf — most findings aren't as urgent as their color suggests, and a "medium" reachable from the internet can outrank a "critical" that isn't exploitable in your setup. This skill triages a vulnerability by real, contextual risk: base severity adjusted for exploitability and exposure, with a fix and a fix-by SLA. For assets you own or are authorized to assess.
Required Inputs
Ask for these only if they aren't already provided:
- The finding — the CVE/scanner/pentest item: what it is, affected component/version, CVSS if given.
- Your context — is the affected component reachable (internet-facing? authenticated-only? internal?), what data/privilege it touches, compensating controls in place.
- Exploit status — is there a known public exploit / is it being exploited in the wild (e.g. on CISA KEV)?
- Environment — prod vs. non-prod, blast radius, business criticality.