Menu
Scoring rubric for prioritizing CVEs by severity, exploitability, and exposure
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when deploying, operating, or migrating AI agents on Amazon Bedrock AgentCore — creating harnesses or runtime agents, adding skills/tools/gateways/memory/credentials, exporting a harness to code, or migrating AI assistant configurations (.github/agents, .claude/skills, .cursor/rules, MCP configs, hooks) from coding assistants. Triggers: 'migrate to AgentCore', 'agentcore migration', 'deploy to agentcore', 'create harness', 'export harness', 'add skill to harness', 'convert MCP to gateway', 'export agents to AWS', 'move agents to bedrock', 'agentcore harness', 'invoke agent runtime', 'agentcore deploy fails'.
Use when authoring, validating, or debugging standalone AWS CloudFormation templates (YAML/JSON) — writing or editing resources with secure defaults, running cfn-lint / cfn-guard / change-set validation before deploy, or diagnosing a failed or rolled-back stack via CloudFormation events and CloudTrail. Triggers: 'write a CloudFormation template', 'validate my template', 'cfn-lint', 'cfn-guard', 'change set', 'CREATE_FAILED', 'ROLLBACK_COMPLETE', 'stack stuck in UPDATE_ROLLBACK_FAILED'. For SAM/serverless-specific templates use aws-serverless; for end-to-end architecture design that emits IaC use aws-solution-architect.
Use when working with core AWS services outside the serverless and IaC specialist skills — EC2, S3, VPC/networking, IAM policies, RDS, ECS, CloudWatch, Secrets Manager — via the AWS CLI/console/boto3. Triggers - "launch an EC2 instance", "S3 bucket policy", "create a VPC", "IAM role/policy", "RDS setup", "ECS service", "CloudWatch alarm". For CloudFormation templates use aws-cloudformation; for Lambda/API-Gateway serverless code use aws-serverless; for architecture design + cost optimization use aws-solution-architect.
Use when implementing production serverless workloads on AWS — writing Lambda handler code, wiring API Gateway / DynamoDB Streams / SQS / SNS event-driven flows, SAM or CDK deployment, or fixing cold starts. Triggers: 'write a Lambda function', 'SAM template', 'API Gateway + Lambda', 'SQS consumer', 'DynamoDB stream processor', 'cold start optimization'. For standalone CloudFormation authoring use aws-cloudformation; for architecture selection + cost design use aws-solution-architect.
Use when asked to design serverless architecture, create CloudFormation templates, optimize AWS costs, set up CI/CD pipelines, or migrate to AWS. Design AWS architectures for startups using serverless patterns and IaC templates. Covers Lambda, API Gateway, DynamoDB, ECS, Aurora, and cost optimization. For editing/validating an existing raw CloudFormation stack use aws-cloudformation; for writing Lambda/event handler code use aws-serverless.
| name | cve-triage |
| description | Scoring rubric for prioritizing CVEs by severity, exploitability, and exposure |
Assign priority:
| Priority | Criteria |
|---|---|
| P1 | CVSS ≥ 9.0, or known exploited (KEV), internet-facing asset |
| P2 | CVSS 7.0–8.9 with public PoC, or KEV on internal asset |
| P3 | CVSS 4.0–6.9, no known exploitation |
| P4 | CVSS < 4.0, or not applicable to our stack |
Always check: is the vulnerable component actually reachable in our deployment? If not, downgrade one level and note why.
