vulnerability-analysis

name	vulnerability-analysis
description	Perform deep analysis of CVEs and security vulnerabilities including CVSS scoring, affected versions, exploit maturity, and remediation steps. Use when the user needs detailed vulnerability intelligence.

Vulnerability Analysis

Use this skill when the user asks for detailed vulnerability analysis beyond basic CVE lookup.

When to Use

• User asks "how serious is this vulnerability?"
• User asks about exploit availability or PoC code
• User wants to understand impact on their specific infrastructure
• User asks about mitigation or remediation steps
• User wants to prioritize which vulnerabilities to fix first

Workflow

1. Gather Vulnerability Data

Start with built-in OASM tools to get workspace context:

Tool	Purpose
discover_vulnerabilities	List vulns matching a query (e.g., "CVE-2024", "XSS")
investigate_vulnerability	Get full details on a specific vulnerability by ID
enumerate_assets	Find assets that may run affected software
fingerprint_technologies	Identify technologies in use to check exposure
list_network_ports	Check if vulnerable services are exposed
enumerate_open_issues	See if the vulnerability is already tracked

2. Enrich with External Sources

For deeper analysis, use retrieve_web_page to fetch from these sources:

CVE Details:

• Trickest CVE: https://raw.githubusercontent.com/trickest/cve/refs/heads/main/{YEAR}/CVE-{YEAR}-{NUMBER}.md
• NVD API: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-{YEAR}-{NUMBER}

Exploit Intelligence:

• GitHub PoC search: https://github.com/nomi-sec/PoC-in-GitHub
• Exploit-DB: https://www.exploit-db.com/search
• Metasploit modules: https://www.rapid7.com/db/modules/

Vendor Advisories:

• Microsoft MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-{YEAR}-{NUMBER}
• Apache security: https://lists.apache.org/thread/

3. Analyze the Vulnerability

For each vulnerability, evaluate these dimensions:

Severity Assessment

• CVSS v3.1 base score and vector string
• EPSS (Exploit Prediction Scoring System) if available
• CISA KEV (Known Exploited Vulnerabilities) catalog status
• Contextual severity: is the affected component internet-facing?

Exploit Maturity

Categorize the exploit status:

• None: No known exploits
• PoC: Proof-of-concept code exists (GitHub, write-ups)
• Functional: Exploit works reliably but not mass-deployed
• Weaponized: Used in real attacks, available in exploit frameworks

Affected Scope

• List affected products and versions from the CVE
• Cross-reference with workspace assets using enumerate_assets and fingerprint_technologies
• Determine exposure: internet-facing vs internal-only

Remediation Guidance

• Patch availability and version
• Workarounds if no patch exists (WAF rules, network segmentation, disable feature)
• Priority level:
  • Immediate: Exploited in the wild (check CISA KEV)
  • High: Functional exploit or PoC available
  • Medium: Vulnerable but no known exploit
  • Low: Informational or low-impact

4. Present Findings

Structure your analysis as:

**Summary**: One-line overview of the vulnerability

**Severity**: CVSS score + vector + EPSS (if available)

**Exploit Status**: None / PoC / Functional / Weaponized

**Affected Assets**: X assets in your workspace match
- asset1.example.com (nginx 1.18)
- asset2.example.com (Apache 2.4.49)

**Impact**: What an attacker can achieve (e.g., RCE, data leak, DoS)

**Remediation**: Specific steps with version numbers
- Upgrade to X.Y.Z or later
- Temporary: apply WAF rule / disable feature

**Priority**: Immediate / High / Medium / Low

5. Track the Issue

After analysis:

• If no existing issue, suggest creating one via the Issues system
• Store key findings in stm_write for reference during the conversation
• Use ltm_append to persist critical vulnerability intelligence for the workspace