exploits
Analyze exploit intelligence for a vulnerability against the current repository
Profile →npx skills add davepoon/buildwithclaude --skill exploits --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Analyzes exploit intelligence for a specific vulnerability (CVE, GHSA, etc.) and assesses its impact against the current repository. It does not modify application code; it only updates .vulnetix/memory.yaml to track findings. Use /vulnetix:fix for remediation.
How it works
The skill processes vulnerability data to produce a markdown report of exploit context, potential attack techniques, CWSS-derived priority, and related indicators. It uses a tooling cascade to extract and shape data from JSON/YAML inputs via jq/yq and shell utilities, and may generate visual diagrams with Mermaid (attack paths, CWSS factors, timelines). It updates the memory file with threat_model and cwss fields for the vulnerability entry and records decisions and history entries. It can pull in Dependabot and Code Scanning data when the gh CLI is available to enrich the assessment:
- Load vulnerability memory and, if present, incorporate open alerts or PRs.
- For Code Scanning, identify CWE-matching alerts and report their state; note autofix availability if present.
- Populate threat_model.techniques using internal mapping rules, and populate threat_model.tactics with developer-friendly descriptions.
When to use it
Invoke for a vulnerability ID (e.g., CVE-XXXX) to analyze exploit context against the repository, quantify risk with CWSS factors, and record findings in memory. It should be used when preparing an exploit-focused assessment that will later be remediated via /vulnetix:fix.
What it can touch
- .vulnetix/memory.yaml (reads and updates per-vulnerability entries with threat_model and cwss fields)
- The workflow may query:
- Dependabot alerts via gh api (if gh is available)
- Code Scanning alerts via gh api (if gh is available)
- Outputs are formatted markdown reports including optional Mermaid diagrams
Caveats
- This skill does not modify application code directly.
- It relies on external tools (jq, yq, gh, uv, python) being available per the cascading rules; if unavailable, it falls back to manual CWSS calculations and markdown reporting.
- It updates memory in a shared YAML file structure defined in /vulnetix:fix; ensure memory schema compatibility prior to use.
# Vulnetix Exploit Analysis Skill This skill analyzes exploit intelligence for a specific vulnerability (CVE, GHSA, etc.) and assesses its impact against the current repository. **This skill does not modify application code** — it only updates `.vulnetix/memory.yaml` to track findings. Use `/vulnetix:fix` for remediation. ## Output & Analysis Guidelines **Primary output format:** Markdown. All reports, tables, assessments, and evidence summaries MUST be presented as formatted markdown text directly — never generate scripts or programs to produce output that can be expressed as markdown. **Visual data — use Mermaid diagrams** to display data visually when it aids comprehension. Mermaid renders natively in markdown and requires no external tools. Use it for: - Attack path / kill chain visualization → `graph TD` - CWSS factor breakdown → `pie` or `quadrantChart` - Exploit timeline (discovery dates, PoC releases) → `timeline` - Threat model reachability → `flowchart` (dependency → vulnerable code → exposure) - Priority comparison across multiple vulns → `bar` or `xychart-beta` Example — CWSS factor breakdown: ````markdown ```mermaid pie title CWSS Priority Factors (Score: 87.5) "Techni
- Output & Analysis Guidelines
- Vulnerability Memory (.vulnetix/memory.yaml)
- Schema
- MITRE ATT&CK Mapping
- CWSS Priority Scoring
- Risk Treatment Decisions
- Dependabot Integration
- Code Scanning (CodeQL) Integration
- Secret Scanning Integration
- Reading Prior State and SBOMs
- Writing Updated State
- Workflow
- Step 1: Load Vulnerability Memory
- Step 2: Fetch Exploit Data
command -v uv &>/dev/null && uv run --with matplotlib python3 -c '
import matplotlib.pyplot as plt
command -v uv &>/dev/null && uv run --with pandas,matplotlib python3 -c '...'
command -v python3 &>/dev/null && python3 -c 'import json, sys; ...'
gh pr list --author "app/dependabot" --state all --json number,title,state,url --limit 50 | jq '[.[] | select(.title | test("'"$PACKAGE_NAME"'"; "i"))] | first'
gh api repos/{owner}/{repo}/code-scanning/alerts --jq '[.[] | select(.rule.tags[]? | test("CWE-<NUMBER>"; "i"))]'
gh api repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix --jq '.status'
gh api repos/{owner}/{repo}/secret-scanning/alerts?state=open
vulnetix vdb exploits "$ARGUMENTS" -o json
vulnetix vdb exploits "$ARGUMENTS" -o json -V v2What does the exploits skill do?
Analyze exploit intelligence for a vulnerability against the current repository
How do I install it?
Run `npx skills add davepoon/buildwithclaude --skill exploits --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From davepoon/buildwithclaude, a repository with 3,251 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.