--- name: vulnerability-prioritization description: > Prioritize CVEs or vulnerability scan findings using real exposure data, not just CVSS score. Use this skill whenever a user pastes a CVE ID, a list of CVEs, a vulnerability scan export, or asks "should we patch this now", "is this CVE actively exploited", "what's our exposure to X", or "help me prioritize this vuln list". Also trigger on any pasted scanner output (Nessus/ Qualys/Elasticsearch vuln export style rows) or when a user references CVSS scores and wants a patch-order recommendation. Do not use for general "explain this vulnerability" education requests with no prioritization ask — for those, answer directly. --- # Vulnerability Prioritization Skill Turns a CVE or a vuln-scan list into a patch-order recommendation by combining public severity data with actual internal exposure — the thing CVSS alone can't tell you. --- ## Workflow Overview ``` 1. Parse CVEs → 2. Pull public severity/exploit data → 3. Check internal exposure → 4. Compute priority score → 5. Render patch-order report ``` --- ## Step 1 — Parse CVEs Extract every CVE ID from the input with `polarity:parse_entities`. If the input is a scan export with host/asset columns, keep the CVE-to-asset mapping intact — exposure is meaningless without it. --- ## Step 2 — Pull Public Severity & Exploit Data For each CVE, run in parallel via `polarity:do_integration_lookup`: | Source | ID | What it adds | |---|---|---| | National Vulnerability Database | `national_vulnerability_database_3_0_0_node_18_e19c410b60_1706110998` | CVSS score, CPEs, CWE class | | CISA Known Exploited Vulnerabilities | `cisa_vuln` | Confirmed active exploitation in the wild | | Exploit Finder | `exploit_finder` | Public PoC / exploit code availability | | Google Threat Intel | `google_threat_intelligence_3_1_2_node_18_bf9adae49f_1750966364421` | Threat-actor/campaign linkage to this CVE | | Mandiant Threat Intelligence | `mandiant_threat_intelligence_3_3_2_node_18_2e51baaa57_1697658645` | Adversary context, targeted sectors | --- ## Step 3 — Check Internal Exposure This is the step generic CVE lookups skip — and the one that actually changes patch order. | Source | ID | What it tells you | |---|---|---| | CrowdStrike Exposure Management (Spotlight) | `crowdstrike_exposure_3_0_3_node_18_f89390a1d9_1782921542885` | Which hosts are actually exposed to this CVE | | Elasticsearch - Vuln | `elasticsearch_3_6_3_node_18_1fed945c7a_1724331215` | Internal scan hits for this CVE/IP | | ORCA Security | `orca` | Cloud workload exposure (AWS/Azure/GCP) | | Axonius | `axonius_3_5_2_node_18_38fbb69596_1761866620482` | Asset criticality/business context for affected hosts | | Jira | `jira` | Whether a remediation ticket already exists | If none of these return hits for a CVE, say so explicitly rather than assuming zero exposure — absence of a scan hit can mean "not scanned" as easily as "not present." --- ## Step 4 — Compute Priority Score (0–100) | Factor | Points | |---|---| | Listed in CISA KEV | +30 | | Actual internal exposure confirmed (Spotlight/ORCA/ES-Vuln hit) | +25 | | Public exploit/PoC available (Exploit Finder hit) | +15 | | CVSS ≥ 9.0 | +15 | | Attributed to an active threat actor/campaign | +10 | | Affects an internet-facing or business-critical asset (Axonius) | +5 | Deductions: | Factor | Deduction | |---|---| | No confirmed internal exposure across any source | -30 | | CVSS < 4.0 and not in KEV | -15 | | Compensating control already in place (WAF rule, network segmentation noted in Jira) | -10 | ### Priority Tiers | Score | Tier | Patch SLA | |---|---|---| | 70–100 | CRITICAL — patch now | 24–48 hours | | 45–69 | HIGH — patch this cycle | 1–2 weeks | | 20–44 | MODERATE — scheduled patch | Next maintenance window | | 0–19 | LOW / NOT EXPOSED | Track, no urgent action | --- ## Step 5 — Render Patch-Order Report Render via `visualize:show_widget`. Required sections: 1. **Header** — count of CVEs assessed, how many are CRITICAL/HIGH 2. **Patch-order table** — CVE | CVSS | KEV? | Exploit available? | Exposed assets (count) | Priority tier — sorted by score descending, not by CVSS 3. **Per-CVE detail cards** (top 5 by score) — description, affected products, fix version, workaround, which internal assets are confirmed exposed 4. **Exposure gaps** — CVEs where no internal exposure data was found, flagged for a scan 5. **Recommended patch order** — numbered list, tier-badged, with SLA 6. **Footer** — sources queried per CVE, scan data freshness if known ### Visual Design Rules (all reports) Follow the claude.ai design system exactly: - **No hardcoded hex colors.** Use only CSS variables: `--color-background-primary/secondary/tertiary`, `--color-text-primary/secondary/tertiary`, `--color-border-tertiary/secondary`, `--color-background-danger/warning/info/success`, `--color-text-danger/warning/info/success`. - **Dark mode mandatory** — every element must be readable on a near-black background. - Font sizes: section labels 11–12px uppercase tracking, body 13–14px, metric numbers 20–24px. Font weights: 400 body, 500 headings/labels only. Never 600 or 700. - Cards: `background: var(--color-background-primary); border: 0.5px solid var(--color-border-tertiary); border-radius: 12px; padding: 1rem 1.25rem`. - Badges: `display: inline-block; padding: 4px 12px; border-radius: 6px; font-size: 12px; font-weight: 500` using semantic CSS vars for bg + text. - Section separators: `border-top: 0.5px solid var(--color-border-tertiary)`. - Tabler outline icons only (`