| name | vulnerability-assessment |
| description | Assess a specific CVE or vulnerability against the organization's technology stack. Determine exposure, severity, and remediation steps. Trigger with "assess CVE-XXXX", "are we affected by [vulnerability]", "check [CVE]", or "vulnerability impact". |
Vulnerability Assessment
Assess a specific vulnerability's impact on the organization.
When to Use
- New CVE announced that might affect the stack
- User asks about a specific vulnerability
- Post-incident review of exploited vulnerabilities
Steps
- Look up the CVE details (CVSS score, affected versions, attack vector)
- Check against the organization's known technology stack
- Assess exposure: is the vulnerable component deployed, internet-facing, or configured to be exploitable
- Determine remediation: patch available, workaround, or mitigation
- Provide clear action plan with timeline
Output Format
## Vulnerability Assessment -- [CVE ID]
| Field | Detail |
|-------|--------|
| **CVE** | [ID] |
| **CVSS** | [Score] / 10 |
| **Affects** | [Software and versions] |
| **Your Exposure** | [Yes/No -- which component, which environment] |
| **Exploitation** | [Active / PoC available / Theoretical] |
### Impact
[What an attacker could do if exploited]
### Remediation
1. [Primary fix -- patch version]
2. [Workaround if patch not immediate]
3. [Monitoring steps while unpatched]
### Timeline
- **Immediate**: [What to do now]
- **This Week**: [Scheduled remediation]
- **Ongoing**: [Verification and monitoring]
