Cve triage
Scoring rubric for prioritizing CVEs by severity, exploitability, and exposureFrom its SKILL.md
npx -y skills add LeonMelamud/agentcore-toolkit --skill cve-triageAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
0.5 KB, as published. Nobody here has run it
CVE Triage Rubric
Assign priority:
| Priority | Criteria |
|---|---|
| P1 | CVSS ≥ 9.0, or known exploited (KEV), internet-facing asset |
| P2 | CVSS 7.0–8.9 with public PoC, or KEV on internal asset |
| P3 | CVSS 4.0–6.9, no known exploitation |
| P4 | CVSS < 4.0, or not applicable to our stack |
Always check: is the vulnerable component actually reachable in our deployment? If not, downgrade one level and note why.