agentsclimarketplace

Vulnerability triage

Skill Amey-Thakur/AI-SKILLS/skills/security/vulnerability-triage

Plug-and-play skills and prompts for every AI coding agent

Install
npx -y skills add Amey-Thakur/AI-SKILLS --skill vulnerability-triage

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 20 days oldThe repository was created 20 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Score incoming vulnerability reports the same way every time, tie each score to a fix deadline, and run disclosure on a predictable clock. Use when a vulnerability report arrives or when standing up a process to handle them.

SKILL.md

2.7 KB, 609 tokens by cl100k_base, as published. Nobody here has run it

Vulnerability triage

A stream of vulnerability reports with no method produces panic or paralysis: everything feels urgent, so nothing gets a real deadline. The cure is to score every report by the same rule, convert the score into a due date, and answer the reporter on a schedule they can predict.

Method

  1. Reproduce before you rate. Close duplicates and non-issues fast. For the rest, capture the affected version, the attack prerequisites, and a minimal reproduction, so the score rests on facts and not on the reporter's adjectives.
  2. Score with CVSS 3.1 and keep the vector string. Compute the base score from 0 to 10 and store the full vector (AV, AC, PR, UI, and the rest) so anyone can audit the rating later. Apply environmental metrics when your deployment differs from the generic assumption.
  3. Convert the score into a fix window. Critical (9.0 to 10.0) inside 7 days, High (7.0 to 8.9) inside 30, Medium (4.0 to 6.9) inside 90, Low into the next planned release. Start the clock at triage, not at the fix.
  4. Weight by real exploitability, not the base number. A Medium with a public exploit or active use in the wild (check the CISA KEV catalog) jumps the line. Internet-reachable and unauthenticated outranks a bug that sits behind admin login.
  5. Track every report in one system with named states: reported, triaged, fixed, verified, disclosed. Assign an owner to each finding, because a vulnerability nobody owns is a vulnerability nobody is fixing.
  6. Disclose on a stated timeline. Acknowledge the reporter inside a fixed window, agree an embargo (90 days is common), request a CVE, and publish an advisory naming affected and fixed versions when the patch ships.
  7. Verify the class is closed, not just the case. Re-run the original reproduction and its obvious variants, then land a regression test so the same bug cannot quietly return two releases later.

Signals

  • Does every open report carry a CVSS vector, an owner, and a due date?
  • Is any Critical past its 7-day window with no explicit escalation on record?
  • Could you produce the advisory and CVE for the last vulnerability you shipped a fix for?

Boundaries

CVSS rates technical severity, not business impact: a low-scored bug on a crown-jewel system can still deserve the front of the queue, and that call is human. Legal and communications own the public wording of a major incident. This skill gets the fix scheduled and the facts straight.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most debug triage skills give in 609 tokens

Counted across 839 of the 1,149 authors here whose files we hold, read 2026-08-07

  • Investigate root cause before proposing any fixin 102 of 839, across 67 files
  • Read error messages completelyin 89 of 839, across 49 files
  • Create a failing test case before fixingin 84 of 839, across 46 files
  • Reproduce the issue consistentlyin 82 of 839, across 41 files
  • Change one variable at a timein 82 of 839, across 42 files
  • Check recent changesin 74 of 839, across 36 files
  • Write the regression test before fixingin 74 of 839, across 40 files
  • Fix the root cause not the symptomin 60 of 839, across 45 files
  • Implement a single fix at a timein 59 of 839, across 20 files
  • Trace data flow backward to the sourcein 50 of 839, across 20 files
  • Remove all debug instrumentationin 49 of 839, across 13 files
  • Form a single hypothesisin 48 of 839, across 18 files

Said here and by no other author read

  • reproduce the vulnerability before rating it
  • close duplicates and non-issues fast
  • capture the affected version and attack prerequisites
  • compute the CVSS 3.1 base score
  • store the full CVSS vector string
  • convert the score into a fix window

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.