| name | vulnerability-risk-prioritisation |
| description | Prioritises vulnerabilities in business terms using exposure, asset criticality, exploitability, compensating controls, and operational impact rather than CVSS alone. Use when: remediation urgency is unclear, leadership needs a priority view, or delayed remediation must be justified.
|
| license | MIT |
| compatibility | opencode |
| metadata | {"owner":"ciso-advisor","type":"read-write","approval":"No"} |
vulnerability-risk-prioritisation
Owner: ciso-advisor
Type: read-write
Approval: No
What I Do
Turn vulnerability data into an ownership and urgency view that management can act on.
When to Use Me
- A vulnerability must be prioritised beyond CVSS
- Remediation urgency needs business framing
- Overdue remediation needs management language
Context Requirements
Requires already loaded:
.crux/workspace/ciso-advisor/MEMORY.md
Loads during execution (lazy):
.crux/docs/risk-framing-patterns.md
Estimated token cost: ~320 tokens
Unloaded after: task completion
Inputs
| Input | Source | Required |
|---|
vulnerability-context | user / scanner / report | Yes |
asset-context | user / MEMORY.md | No |
Steps
1. Identify exposure, asset importance, exploitability, and control context
2. Judge urgency in business and operational terms
3. Identify remediation owner, validation owner, and risk acceptance owner if needed
4. Return a clear priority recommendation
5. Skill complete — unload
Output
Writes to: no file required by default
Format: markdown
Error Handling
| Condition | Action |
|---|
| Asset context is weak | State reduced confidence and what is missing |
| Compensating controls are claimed but unverified | Mark them as assumed, not proven |
| Unexpected failure | Stop. Write error to bus. Notify user. |
