cve-intel

name	cve-intel
description	Support penetration-testing agents with vulnerability intelligence, exploitability analysis, and user-facing CVE Q&A.
recommended_tools	["cve_search_local","cve_fetch_online","cve_sync_sources","vuln_kb_lookup","web_search","web_fetch","shell_exec"]

CVE Intel

Use this skill during penetration testing when the agent needs vulnerability intelligence, exploitability judgement, or user-facing answers about CVEs and related exposure.

When To Use

• The target service, product, banner, or version needs to be mapped to likely CVEs or KEV exposure.
• The agent needs to decide whether a public CVE is relevant enough to test, verify, or chain during exploitation.
• The user asks whether a CVE is exploitable, weaponized, high-signal, or worth prioritizing in the current engagement.
• The user asks for CVE explanation, mitigation context, or exploit-precondition Q&A.

Operating Rules

• Prefer cve_search_local or vuln_kb_lookup first for cached CVE/KEV facts.
• Use cve_fetch_online when the user needs current NVD details, change history, or the local cache is obviously stale.
• Use cve_sync_sources only when the local corpus is missing expected data or the user explicitly asks to refresh sources.
• Use web_search and web_fetch for vendor advisories, exploitation writeups, and product/version context that CVE feeds alone do not capture.
• Use shell_exec only for local version triage, banner parsing, or artifact inspection inside the allowed scope.
• Keep failures visible. Do not fabricate affected versions, exploit maturity, or patch status.

Analysis Workflow

1. Identify the asset, version evidence, or user question.
2. Map the target to candidate products, versions, and CVE IDs.
3. Check KEV status, public references, and whether exploitation prerequisites match the observed target.
4. Distinguish clearly between suspected exposure and confirmed relevance.
5. State what evidence is still missing before exploitation claims become solid.

Output

• Name the source used: local-cache, nvd-online, sync-refresh, or web-corroborated.
• Surface KEV status and known public exploitation signals explicitly.
• State the target evidence used for version matching.
• Separate suspected from confirmed.
• When discussing exploitability, call out prerequisites, likely attack path, and blockers rather than jumping straight to a definitive exploit claim.