CVE exploitability triage

A vulnerability scan returns a list. The list is almost always longer than the team's capacity to act on it, and sorting that list by CVSS severity produces a bad ordering: CVSS scores intrinsic technical severity, not the likelihood that anyone will actually attack you through it. The CVSS v3.1 specification says so directly, telling consumers to feed CVSS into "an organizational vulnerability management process that also considers factors that are not part of CVSS" (CVSS v3.1 specification).

This skill supplies those other factors and turns them into an ordering. It takes a list of CVE findings that some scanning step has already produced, enriches each with exploitation signal, and emits a four-bucket priority assignment plus a report.

In scope: which CVEs matter, in what order, and why.