Vuln Triage

---
name: vuln-triage
description: "Triage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red."
---

# Vulnerability Triage Skill

Scanners cry wolf — most findings aren't as urgent as their color suggests, and a "medium" reachable from the
internet can outrank a "critical" that isn't exploitable in your setup. This skill triages a vulnerability by
**real, contextual risk**: base severity adjusted for exploitability and exposure, with a fix and a
fix-by SLA. For assets you own or are authorized to assess.

## Required Inputs

Ask for these only if they aren't already provided:

- **The finding** — the CVE/scanner/pentest item: what it is, affected component/version, CVSS if given.
- **Your context** — is the affected component reachable (internet-facing? authenticated-only? internal?), what data/privilege it touches, compensating controls in place.
- **Exploit status** — is there a known public exploit / is it being exploited in the wild (e.g. on CISA KEV)?
- **Environment** — prod vs. non-prod, blast radius, business criticality.

## Output Format

### Triage: [vuln / CVE / finding]

**Verdict** — one line: the contextual severity (Critical/High/Medium/Low) and the action (patch now / schedule / mitigate / accept), with the key reason.

**Assessment**
- **Base severity** — CVSS base score/vector if available, and what it means.
- **Exploitability** — is it reachable in *your* deployment? Preconditions (auth, network position, user interaction)? Public exploit / known exploited in the wild?
- **Impact if exploited** — the assets/data/privilege at stake; blast radius.
- **Contextual severity** — the base rating **adjusted** for the above (exposure + exploitability + compensating controls). Justify any change from the base.

**Remediation**
- **Fix** — the patch/upgrade/config change that resolves it.
- **Mitigation** — if you can't patch immediately: the interim control (WAF rule, disable feature, network restriction, rotate creds).
- **Fix-by SLA** — the deadline given the contextual severity (e.g. critical-exposed → hours; low-internal → next cycle).

**Verification & notes** — how to confirm it's fixed, and any monitoring to add.

## Quality Checks

- [ ] Severity is assessed in context (exposure, exploitability, compensating controls) — not just the raw CVSS/scanner color
- [ ] Exploitability covers reachability, preconditions, and public/in-the-wild exploit status
- [ ] Both a real fix and an interim mitigation (if not immediately patchable) are given
- [ ] A fix-by SLA is assigned proportional to the contextual severity
- [ ] Verification and any monitoring/detection follow-ups are noted

## Anti-Patterns

- [ ] Do not treat the scanner's rating as the answer — adjust for reachability and real impact
- [ ] Do not ignore exploit status — a known-exploited (KEV) bug jumps the queue regardless of score
- [ ] Do not give only "patch it" with no interim mitigation when patching will take time
- [ ] Do not assign a generic SLA — tie urgency to the contextual severity
- [ ] Do not triage assets you don't own or aren't authorized to assess

## Based On

Vulnerability management practice (CVSS base/temporal/environmental, exploitability & KEV context, risk-based SLAs).