메뉴
Scoring rubric for prioritizing CVEs by severity, exploitability, and exposure
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when deploying, operating, or migrating AI agents on Amazon Bedrock AgentCore — creating harnesses or runtime agents, adding skills/tools/gateways/memory/credentials, exporting a harness to code, or migrating AI assistant configurations (.github/agents, .claude/skills, .cursor/rules, MCP configs, hooks) from coding assistants. Triggers: 'migrate to AgentCore', 'agentcore migration', 'deploy to agentcore', 'create harness', 'export harness', 'add skill to harness', 'convert MCP to gateway', 'export agents to AWS', 'move agents to bedrock', 'agentcore harness', 'invoke agent runtime', 'agentcore deploy fails'.
Use when authoring, validating, or debugging standalone AWS CloudFormation templates (YAML/JSON) — writing or editing resources with secure defaults, running cfn-lint / cfn-guard / change-set validation before deploy, or diagnosing a failed or rolled-back stack via CloudFormation events and CloudTrail. Triggers: 'write a CloudFormation template', 'validate my template', 'cfn-lint', 'cfn-guard', 'change set', 'CREATE_FAILED', 'ROLLBACK_COMPLETE', 'stack stuck in UPDATE_ROLLBACK_FAILED'. For SAM/serverless-specific templates use aws-serverless; for end-to-end architecture design that emits IaC use aws-solution-architect.
Use when working with core AWS services outside the serverless and IaC specialist skills — EC2, S3, VPC/networking, IAM policies, RDS, ECS, CloudWatch, Secrets Manager — via the AWS CLI/console/boto3. Triggers - "launch an EC2 instance", "S3 bucket policy", "create a VPC", "IAM role/policy", "RDS setup", "ECS service", "CloudWatch alarm". For CloudFormation templates use aws-cloudformation; for Lambda/API-Gateway serverless code use aws-serverless; for architecture design + cost optimization use aws-solution-architect.
Use when implementing production serverless workloads on AWS — writing Lambda handler code, wiring API Gateway / DynamoDB Streams / SQS / SNS event-driven flows, SAM or CDK deployment, or fixing cold starts. Triggers: 'write a Lambda function', 'SAM template', 'API Gateway + Lambda', 'SQS consumer', 'DynamoDB stream processor', 'cold start optimization'. For standalone CloudFormation authoring use aws-cloudformation; for architecture selection + cost design use aws-solution-architect.
Use when asked to design serverless architecture, create CloudFormation templates, optimize AWS costs, set up CI/CD pipelines, or migrate to AWS. Design AWS architectures for startups using serverless patterns and IaC templates. Covers Lambda, API Gateway, DynamoDB, ECS, Aurora, and cost optimization. For editing/validating an existing raw CloudFormation stack use aws-cloudformation; for writing Lambda/event handler code use aws-serverless.
| name | cve-triage |
| description | Scoring rubric for prioritizing CVEs by severity, exploitability, and exposure |
Assign priority:
| Priority | Criteria |
|---|---|
| P1 | CVSS ≥ 9.0, or known exploited (KEV), internet-facing asset |
| P2 | CVSS 7.0–8.9 with public PoC, or KEV on internal asset |
| P3 | CVSS 4.0–6.9, no known exploitation |
| P4 | CVSS < 4.0, or not applicable to our stack |
Always check: is the vulnerable component actually reachable in our deployment? If not, downgrade one level and note why.
