Vulnerability Assessment

---
name: vulnerability-assessment
description: Assess a specific CVE or vulnerability against the organization's technology stack. Determine exposure, severity, and remediation steps. Trigger with "assess CVE-XXXX", "are we affected by [vulnerability]", "check [CVE]", or "vulnerability impact".
---

# Vulnerability Assessment

Assess a specific vulnerability's impact on the organization.

## When to Use
- New CVE announced that might affect the stack
- User asks about a specific vulnerability
- Post-incident review of exploited vulnerabilities

## Steps
1. Look up the CVE details (CVSS score, affected versions, attack vector)
2. Check against the organization's known technology stack
3. Assess exposure: is the vulnerable component deployed, internet-facing, or configured to be exploitable
4. Determine remediation: patch available, workaround, or mitigation
5. Provide clear action plan with timeline

## Output Format
```markdown
## Vulnerability Assessment -- [CVE ID]

| Field | Detail |
|-------|--------|
| **CVE** | [ID] |
| **CVSS** | [Score] / 10 |
| **Affects** | [Software and versions] |
| **Your Exposure** | [Yes/No -- which component, which environment] |
| **Exploitation** | [Active / PoC available / Theoretical] |

### Impact
[What an attacker could do if exploited]

### Remediation
1. [Primary fix -- patch version]
2. [Workaround if patch not immediate]
3. [Monitoring steps while unpatched]

### Timeline
- **Immediate**: [What to do now]
- **This Week**: [Scheduled remediation]
- **Ongoing**: [Verification and monitoring]
```