vuln-triage
Triage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red.
npx skills add mohitagw15856/pm-claude-skills --skill vuln-triage --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Vulnerability Triage Skill Scanners cry wolf — most findings aren't as urgent as their color suggests, and a "medium" reachable from the internet can outrank a "critical" that isn't exploitable in your setup. This skill triages a vulnerability by **real, contextual risk**: base severity adjusted for exploitability and exposure, with a fix and a fix-by SLA. For assets you own or are authorized to assess. ## Required Inputs Ask for these only if they aren't already provided: - **The finding** — the CVE/scanner/pentest item: what it is, affected component/version, CVSS if given. - **Your context** — is the affected component reachable (internet-facing? authenticated-only? internal?), what data/privilege it touches, compensating controls in place. - **Exploit status** — is there a known public exploit / is it being exploited in the wild (e.g. on CISA KEV)? - **Environment** — prod vs. non-prod, blast radius, business criticality. ## Output Format ### Triage: [vuln / CVE / finding] **Verdict** — one line: the contextual severity (Critical/High/Medium/Low) and the action (patch now / schedule / mitigate / accept), with the key reason. **Assessment** - **Base severity** — CVSS base scor
- Required Inputs
- Output Format
- Triage: [vuln / CVE / finding]
- Quality Checks
- Anti-Patterns
- Based On
What does the vuln-triage skill do?
Triage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red.
How do I install it?
Run `npx skills add mohitagw15856/pm-claude-skills --skill vuln-triage --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mohitagw15856/pm-claude-skills, a repository with 1,255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.