---
name: vulnerability-prioritization
description: >
  Prioritize CVEs or vulnerability scan findings using real exposure data, not just CVSS score.
  Use this skill whenever a user pastes a CVE ID, a list of CVEs, a vulnerability scan export, or
  asks "should we patch this now", "is this CVE actively exploited", "what's our exposure to X",
  or "help me prioritize this vuln list". Also trigger on any pasted scanner output (Nessus/
  Qualys/Elasticsearch vuln export style rows) or when a user references CVSS scores and wants
  a patch-order recommendation. Do not use for general "explain this vulnerability" education
  requests with no prioritization ask — for those, answer directly.
---

# Vulnerability Prioritization Skill

Turns a CVE or a vuln-scan list into a patch-order recommendation by combining public severity data
with actual internal exposure — the thing CVSS alone can't tell you.

---

## Workflow Overview

```
1. Parse CVEs  →  2. Pull public severity/exploit data  →  3. Check internal exposure
   →  4. Compute priority score  →  5. Render patch-order report
```

---

## Step 1 — Parse CVEs

Extract every CVE ID from the input with `polarity:parse_entities`. If the input is a scan export
with host/asset columns, keep the CVE-to-asset mapping intact — exposure is meaningless without it.

---

## Step 2 — Pull Public Severity & Exploit Data

For each CVE, run in parallel via `polarity:do_integration_lookup`:

| Source | ID | What it adds |
|---|---|---|
| National Vulnerability Database | `national_vulnerability_database_3_0_0_node_18_e19c410b60_1706110998` | CVSS score, CPEs, CWE class |
| CISA Known Exploited Vulnerabilities | `cisa_vuln` | Confirmed active exploitation in the wild |
| Exploit Finder | `exploit_finder` | Public PoC / exploit code availability |
| Google Threat Intel | `google_threat_intelligence_3_1_2_node_18_bf9adae49f_1750966364421` | Threat-actor/campaign linkage to this CVE |
| Mandiant Threat Intelligence | `mandiant_threat_intelligence_3_3_2_node_18_2e51baaa57_1697658645` | Adversary context, targeted sectors |

---

## Step 3 — Check Internal Exposure

This is the step generic CVE lookups skip — and the one that actually changes patch order.

| Source | ID | What it tells you |
|---|---|---|
| CrowdStrike Exposure Management (Spotlight) | `crowdstrike_exposure_3_0_3_node_18_f89390a1d9_1782921542885` | Which hosts are actually exposed to this CVE |
| Elasticsearch - Vuln | `elasticsearch_3_6_3_node_18_1fed945c7a_1724331215` | Internal scan hits for this CVE/IP |
| ORCA Security | `orca` | Cloud workload exposure (AWS/Azure/GCP) |
| Axonius | `axonius_3_5_2_node_18_38fbb69596_1761866620482` | Asset criticality/business context for affected hosts |
| Jira | `jira` | Whether a remediation ticket already exists |

If none of these return hits for a CVE, say so explicitly rather than assuming zero exposure —
absence of a scan hit can mean "not scanned" as easily as "not present."

---

## Step 4 — Compute Priority Score (0–100)

| Factor | Points |
|---|---|
| Listed in CISA KEV | +30 |
| Actual internal exposure confirmed (Spotlight/ORCA/ES-Vuln hit) | +25 |
| Public exploit/PoC available (Exploit Finder hit) | +15 |
| CVSS ≥ 9.0 | +15 |
| Attributed to an active threat actor/campaign | +10 |
| Affects an internet-facing or business-critical asset (Axonius) | +5 |

Deductions:
| Factor | Deduction |
|---|---|
| No confirmed internal exposure across any source | -30 |
| CVSS < 4.0 and not in KEV | -15 |
| Compensating control already in place (WAF rule, network segmentation noted in Jira) | -10 |

### Priority Tiers

| Score | Tier | Patch SLA |
|---|---|---|
| 70–100 | CRITICAL — patch now | 24–48 hours |
| 45–69 | HIGH — patch this cycle | 1–2 weeks |
| 20–44 | MODERATE — scheduled patch | Next maintenance window |
| 0–19 | LOW / NOT EXPOSED | Track, no urgent action |

---

## Step 5 — Render Patch-Order Report

Render via `visualize:show_widget`. Required sections:

1. **Header** — count of CVEs assessed, how many are CRITICAL/HIGH
2. **Patch-order table** — CVE | CVSS | KEV? | Exploit available? | Exposed assets (count) | Priority tier
   — sorted by score descending, not by CVSS
3. **Per-CVE detail cards** (top 5 by score) — description, affected products, fix version, workaround,
   which internal assets are confirmed exposed
4. **Exposure gaps** — CVEs where no internal exposure data was found, flagged for a scan
5. **Recommended patch order** — numbered list, tier-badged, with SLA
6. **Footer** — sources queried per CVE, scan data freshness if known

### Visual Design Rules (all reports)

Follow the claude.ai design system exactly:

- **No hardcoded hex colors.** Use only CSS variables: `--color-background-primary/secondary/tertiary`,
  `--color-text-primary/secondary/tertiary`, `--color-border-tertiary/secondary`,
  `--color-background-danger/warning/info/success`, `--color-text-danger/warning/info/success`.
- **Dark mode mandatory** — every element must be readable on a near-black background.
- Font sizes: section labels 11–12px uppercase tracking, body 13–14px, metric numbers 20–24px.
  Font weights: 400 body, 500 headings/labels only. Never 600 or 700.
- Cards: `background: var(--color-background-primary); border: 0.5px solid var(--color-border-tertiary);
  border-radius: 12px; padding: 1rem 1.25rem`.
- Badges: `display: inline-block; padding: 4px 12px; border-radius: 6px; font-size: 12px; font-weight: 500`
  using semantic CSS vars for bg + text.
- Section separators: `border-top: 0.5px solid var(--color-border-tertiary)`.
- Tabler outline icons only (`<i class="ti ti-NAME" aria-hidden="true">`). Never filled variants.
- Sentence case everywhere. No ALL CAPS section titles.
- No gradients, drop shadows, blur, or glow effects.
- Score/meter bars: plain `<div>` with width `${value}%`, no canvas or chart libraries.
- Always render via `visualize:show_widget` (HTML mode). Call `visualize:read_me` with
  `modules: ["mockup"]` first if not already done this session. One line of prose before the
  widget call, nothing after except an offer to drill into any section.

---

## Handling Edge Cases

**Bulk list (>15 CVEs)**: Batch NVD/KEV lookups first to get a quick severity pass, then only run
the deeper exposure checks (Spotlight, ORCA, ES-Vuln) on anything that scores ≥45 after the public
data alone — don't burn calls on CVEs that are clearly low priority regardless of exposure.

**CVE not yet in NVD (very recent)**: Note it's pending NVD analysis; rely on vendor advisory
language if the user provided it, and check Exploit Finder + CISA KEV directly since KEV entries
can predate a full NVD writeup.

**No exposure-management integration available**: Fall back to Elasticsearch - Vuln and Jira alone,
and say explicitly that exposure confidence is lower without Spotlight/ORCA/Axonius.

**Conflicting exposure signals** (Spotlight says exposed, ES-Vuln scan says patched): Treat as
CRITICAL until reconciled — a stale "patched" scan result is a common false negative. Flag the
conflict directly in the report rather than silently picking one source.
