agentsclimarketplace
Sign in

Vulnerability triage

Skill Amey-Thakur/AI-SKILLS/skills/security/vulnerability-triage

Score incoming vulnerability reports the same way every time, tie each score to a fix deadline, and run disclosure on a predictable clock. Use when a vulnerability report arrives or when standing up a process to handle them.From its SKILL.md

Install
npx -y skills add Amey-Thakur/AI-SKILLS --skill vulnerability-triage

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.7 KB, 609 tokens by cl100k_base, as published. Nobody here has run it

Vulnerability triage

A stream of vulnerability reports with no method produces panic or paralysis: everything feels urgent, so nothing gets a real deadline. The cure is to score every report by the same rule, convert the score into a due date, and answer the reporter on a schedule they can predict.

Method

  1. Reproduce before you rate. Close duplicates and non-issues fast. For the rest, capture the affected version, the attack prerequisites, and a minimal reproduction, so the score rests on facts and not on the reporter's adjectives.
  2. Score with CVSS 3.1 and keep the vector string. Compute the base score from 0 to 10 and store the full vector (AV, AC, PR, UI, and the rest) so anyone can audit the rating later. Apply environmental metrics when your deployment differs from the generic assumption.
  3. Convert the score into a fix window. Critical (9.0 to 10.0) inside 7 days, High (7.0 to 8.9) inside 30, Medium (4.0 to 6.9) inside 90, Low into the next planned release. Start the clock at triage, not at the fix.
  4. Weight by real exploitability, not the base number. A Medium with a public exploit or active use in the wild (check the CISA KEV catalog) jumps the line. Internet-reachable and unauthenticated outranks a bug that sits behind admin login.
  5. Track every report in one system with named states: reported, triaged, fixed, verified, disclosed. Assign an owner to each finding, because a vulnerability nobody owns is a vulnerability nobody is fixing.
  6. Disclose on a stated timeline. Acknowledge the reporter inside a fixed window, agree an embargo (90 days is common), request a CVE, and publish an advisory naming affected and fixed versions when the patch ships.
  7. Verify the class is closed, not just the case. Re-run the original reproduction and its obvious variants, then land a regression test so the same bug cannot quietly return two releases later.

Signals

  • Does every open report carry a CVSS vector, an owner, and a due date?
  • Is any Critical past its 7-day window with no explicit escalation on record?
  • Could you produce the advisory and CVE for the last vulnerability you shipped a fix for?

Boundaries

CVSS rates technical severity, not business impact: a low-scored bug on a crown-jewel system can still deserve the front of the queue, and that call is human. Legal and communications own the public wording of a major incident. This skill gets the fix scheduled and the facts straight.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.