القائمة
Use when triaging CVEs, prioritizing vulnerabilities, or setting remediation SLAs. Triggers on 'CVE', 'vulnerability triage', 'CVSS', 'EPSS', 'SLA for patching', 'reachability'.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
"Use when validating requirements against EARS notation patterns. Triggers on "EARS", "requirement review", "requirement quality", "shall statement", "REQ-ID"."
"Use when mapping business capabilities, identifying overlap or gaps across the enterprise, or aligning IT investments to business outcomes. Triggers on "capability map", "business capability", "domain map", "enterprise architecture"."
"Use when drafting Architecture Decision Records, evaluating alternatives, or documenting technical trade-offs. Triggers on "ADR", "architecture decision", "trade-off", "pick between", "why did we choose"."
"Use when a new engineer joins the team, when onboarding to an unfamiliar codebase, or when auditing whether the team has shared understanding. Triggers on "onboard", "context", "knowledge gap", "bus factor", "team understanding"."
Use when refactoring legacy code, extracting a service, or making behavior-preserving changes. Triggers on 'refactor', 'legacy code', 'strangler fig', 'characterization test', 'mikado method'.
Use when practicing test-driven development, writing a failing test first, or coaching red-green-refactor. Triggers on 'TDD', 'red-green-refactor', 'test first', 'failing test', 'write a test'.
| name | Vulnerability Triage |
| description | Use when triaging CVEs, prioritizing vulnerabilities, or setting remediation SLAs. Triggers on 'CVE', 'vulnerability triage', 'CVSS', 'EPSS', 'SLA for patching', 'reachability'. |
Don't triage by CVSS alone. Combine three signals:
High priority = High/Critical CVSS AND (KEV OR EPSS > 0.1) AND reachable.
A Critical CVSS in a dev-only dependency not on the runtime path is lower priority than a Medium CVSS in an internet-facing service.
| Severity | Internet-facing | Internal | Dev-only |
|---|---|---|---|
| Critical / KEV | 7 days | 14 days | 30 days |
| High | 30 days | 60 days | 90 days |
| Medium | 90 days | 90 days | Next release |
| Low | Next release | Next release | Backlog |
Clock starts at disclosure (or vendor patch), not at scan detection.
