AI agent skill · by @oasm-platform

Vulnerability Analysis

Perform deep analysis of CVEs and security vulnerabilities including CVSS scoring, affected versions, exploit maturity, and remediation steps. Use when the user needs detailed vulnerability intelligence.

Archived 2026-10-23 · Source updated 2026-09-17 · License: GPL-3.0. Check the original repository for the latest version.

SKILL.md instructions

# Vulnerability Analysis

Use this skill when the user asks for detailed vulnerability analysis beyond basic CVE lookup.

## When to Use

- User asks "how serious is this vulnerability?"
- User asks about exploit availability or PoC code
- User wants to understand impact on their specific infrastructure
- User asks about mitigation or remediation steps
- User wants to prioritize which vulnerabilities to fix first

## Workflow

### 1. Gather Vulnerability Data

Start with built-in OASM tools to get workspace context:

| Tool | Purpose |
|---|---|
| `discover_vulnerabilities` | List vulns matching a query (e.g., "CVE-2024", "XSS") |
| `investigate_vulnerability` | Get full details on a specific vulnerability by ID |
| `enumerate_assets` | Find assets that may run affected software |
| `fingerprint_technologies` | Identify technologies in use to check exposure |
| `list_network_ports` | Check if vulnerable services are exposed |
| `enumerate_open_issues` | See if the vulnerability is already tracked |

### 2. Enrich with External Sources

For deeper analysis, use `retrieve_web_page` to fetch from these sources:

**CVE Details:**
- Trickest CVE: `https://raw.githubusercontent.com/trickest/cve/refs/heads/main/{YEAR}/CVE-{YEAR}-{NUMBER}.md`
- NVD API: `https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-{YEAR}-{NUMBER}`

**Exploit Intelligence:**
- GitHub PoC search: `https://github.com/nomi-sec/PoC-in-GitHub`
- Exploit-DB: `https://www.exploit-db.com/search`
- Metasploit modules: `https://www.rapid7.com/db/modules/`

**Vendor Advisories:**
- Microsoft MSRC: `https://msrc.microsoft.com/update-guide/vulnerability/CVE-{YEAR}-{NUMBER}`
- Apache security: `https://lists.apache.org/thread/`

### 3. Analyze the Vulnerability

For each vulnerability, evaluate these dimensions:

#### Severity Assessment
- CVSS v3.1 base score and vector string
- EPSS (Exploit Prediction Scoring System) if available
- CISA KEV (Known Exploited Vulnerabilities) catalog status
- Contextual severity: is the affected component internet-facing?

#### Exploit Maturity
Categorize the exploit status:
- **None**: No known exploits
- **PoC**: Proof-of-concept code exists (GitHub, write-ups)
- **Functional**: Exploit works reliably but not mass-deployed
- **Weaponized**: Used in real attacks, available in exploit frameworks

#### Affected Scope
- List affected products and versions from the CVE
- Cross-reference with workspace assets using `enumerate_assets` and `fingerprint_technologies`
- Determine exposure: internet-facing vs internal-only

#### Remediation Guidance
- Patch availability and version
- Workarounds if no patch exists (WAF rules, network segmentation, disable feature)
- Priority level:
  - **Immediate**: Exploited in the wild (check CISA KEV)
  - **High**: Functional exploit or PoC available
  - **Medium**: Vulnerable but no known exploit
  - **Low**: Informational or low-impact

### 4. Present Findings

Structure your analysis as:

```
**Summary**: One-line overview of the vulnerability

**Severity**: CVSS score + vector + EPSS (if available)

**Exploit Status**: None / PoC / Functional / Weaponized

**Affected Assets**: X assets in your workspace match
- asset1.example.com (nginx 1.18)
- asset2.example.com (Apache 2.4.49)

**Impact**: What an attacker can achieve (e.g., RCE, data leak, DoS)

**Remediation**: Specific steps with version numbers
- Upgrade to X.Y.Z or later
- Temporary: apply WAF rule / disable feature

**Priority**: Immediate / High / Medium / Low
```

### 5. Track the Issue

After analysis:
- If no existing issue, suggest creating one via the Issues system
- Store key findings in `stm_write` for reference during the conversation
- Use `ltm_append` to persist critical vulnerability intelligence for the workspace