Triage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red.
Start a fresh conversation. Replace the highlighted placeholders.
Use vuln-triage to triage [finding, affected version, authorized asset context, exploit status, and environment] and deliver a contextual severity verdict, remediation and mitigation, fix-by SLA, and verification notes.
Required inputs
[finding, affected version, authorized asset context, exploit status, and environment]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: vuln-triagedescription: "Triage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red."
Vulnerability Triage Skill
Scanners cry wolf — most findings aren't as urgent as their color suggests, and a "medium" reachable from the
internet can outrank a "critical" that isn't exploitable in your setup. This skill triages a vulnerability by
real, contextual risk: base severity adjusted for exploitability and exposure, with a fix and a
fix-by SLA. For assets you own or are authorized to assess.
Required Inputs
Ask for these only if they aren't already provided:
The finding — the CVE/scanner/pentest item: what it is, affected component/version, CVSS if given.
Your context — is the affected component reachable (internet-facing? authenticated-only? internal?), what data/privilege it touches, compensating controls in place.
Exploit status — is there a known public exploit / is it being exploited in the wild (e.g. on CISA KEV)?
Environment — prod vs. non-prod, blast radius, business criticality.
Output Format
Triage: [vuln / CVE / finding]
Verdict — one line: the contextual severity (Critical/High/Medium/Low) and the action (patch now / schedule / mitigate / accept), with the key reason.
Assessment
Base severity — CVSS base score/vector if available, and what it means.
Exploitability — is it reachable in your deployment? Preconditions (auth, network position, user interaction)? Public exploit / known exploited in the wild?
Impact if exploited — the assets/data/privilege at stake; blast radius.
Contextual severity — the base rating adjusted for the above (exposure + exploitability + compensating controls). Justify any change from the base.
Remediation
Fix — the patch/upgrade/config change that resolves it.
Mitigation — if you can't patch immediately: the interim control (WAF rule, disable feature, network restriction, rotate creds).
Fix-by SLA — the deadline given the contextual severity (e.g. critical-exposed → hours; low-internal → next cycle).
Verification & notes — how to confirm it's fixed, and any monitoring to add.
Quality Checks
Severity is assessed in context (exposure, exploitability, compensating controls) — not just the raw CVSS/scanner color
Exploitability covers reachability, preconditions, and public/in-the-wild exploit status
Both a real fix and an interim mitigation (if not immediately patchable) are given
A fix-by SLA is assigned proportional to the contextual severity
Verification and any monitoring/detection follow-ups are noted
Anti-Patterns
Do not treat the scanner's rating as the answer — adjust for reachability and real impact
Do not ignore exploit status — a known-exploited (KEV) bug jumps the queue regardless of score
Do not give only "patch it" with no interim mitigation when patching will take time
Do not assign a generic SLA — tie urgency to the contextual severity
Do not triage assets you don't own or aren't authorized to assess