菜单
Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities. Use when working with triaging vulnerabilities with ssvc framework.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/oyi77/1ai-skills --skill triaging-vulnerabilities-with-ssvc-framework命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Android and mobile application security testing — emulators, rooting, traffic interception, dynamic instrumentation. Use when testing mobile apps for vulnerabilities, reversing APKs, or bypassing security controls on Android.
Self-reflection + Self-criticism + Auto-learning from corrections + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when working with self improving.
Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities. Use when working with conducting full scope red team engagement.
基于 SOC 职业分类
正在显示 SKILL.md
| name | triaging-vulnerabilities-with-ssvc-framework |
| description | Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities. Use when working with triaging vulnerabilities with ssvc framework. |
| domain | cybersecurity |
| subdomain | vulnerability-management |
| tags | ["ssvc","vulnerability-triage","cisa","vulnerability-prioritization","decision-tree","cvss","remediation","risk-management"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"] |
The Stakeholder-Specific Vulnerability Categorization (SSVC) framework, developed by Carnegie Mellon University's Software Engineering Institute (SEI) in collaboration with CISA, provides a structured decision-tree methodology for vulnerability prioritization. Unlike CVSS alone, SSVC accounts for exploitation status, technical impact, automatability, mission prevalence, and public well-being impact to produce one of four actionable outcomes: Track, Track*, Attend, or Act.
Trigger phrases:
"triaging vulnerabilities with ssvc framework"
"Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerab"
When managing security operations that require triaging vulnerabilities with ssvc framework
When improving security program maturity and operational processes
When establishing standardized procedures for security team workflows
When integrating threat intelligence or vulnerability data into operations
requests, pandas, and jinja2 librariesThis section covers ssvc decision points for triaging vulnerabilities with ssvc framework.
Assess current exploitation activity:
# Check if a CVE is in CISA Known Exploited Vulnerabilities catalog
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
python3 -c "import sys,json; data=json.load(sys.stdin); cves=[v['cveID'] for v in data['vulnerabilities']]; print('Active' if 'CVE-2024-3400' in cves else 'Check PoC/None')"
Determine scope of compromise if exploited:
Evaluate if exploitation can be automated at scale:
How widespread is the affected product in your environment:
Potential consequences for physical safety and public welfare:
| Outcome | Action Required | SLA |
|---|---|---|
| Track | Monitor, remediate in normal patch cycle | 90 days |
| Track* | Monitor closely, prioritize in next patch window | 60 days |
| Attend | Escalate to senior management, accelerate remediation | 14 days |
| Act | Apply mitigations immediately, executive-level awareness | 48 hours |
import requests
import json
# Fetch CISA KEV catalog
kev_url = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
kev_data = requests.get(kev_url).json()
kev_cves = {v['cveID'] for v in kev_data['vulnerabilities']}
# Fetch EPSS scores for context
epss_url = "https://api.first.org/data/v1/epss"
epss_response = requests.get(epss_url, params={"cve": "CVE-2024-3400"}).json()
def evaluate_exploitation(cve_id, kev_set):
"""Determine exploitation status from CISA KEV and EPSS data."""
if cve_id in kev_set:
return "active"
epss = requests.get(
"https://api.first.org/data/v1/epss",
params={"cve": cve_id}
).json()
if epss.get("data"):
score = float(epss["data"][0].get("epss", 0))
if score > 0.5:
return "poc"
return "none"
def evaluate_technical_impact(cvss_vector):
"""Parse CVSS vector for scope and impact metrics."""
if "S:C" in cvss_vector or "C:H/I:H/A:H" in cvss_vector:
return "total"
return "partial"
def evaluate_automatability(cvss_vector, cve_description):
"""Check if attack vector is network-based with low complexity."""
if "AV:N" in cvss_vector and "AC:L" in cvss_vector and "UI:N" in cvss_vector:
return "yes"
return "no"
def ssvc_decision(exploitation, tech_impact, automatability, mission_prevalence, public_wellbeing):
"""CISA SSVC decision tree implementation."""
if exploitation == "active":
if tech_impact == "total" or automatability == "yes":
return "Act"
if mission_prevalence in ("essential", "support"):
return "Act"
return "Attend"
if exploitation == "poc":
if automatability == "yes" and tech_impact == "total":
return "Attend"
if mission_prevalence == "essential":
return "Attend"
return "Track*"
# exploitation == "none"
if tech_impact == "total" and mission_prevalence == "essential":
return "Track*"
return "Track"
# Run the SSVC triage script against scan results
python3 scripts/process.py --input scan_results.csv --output ssvc_triage_report.json
# View summary
cat ssvc_triage_report.json | python3 -m json.tool | head -50
This section covers integration with vulnerability scanners for triaging vulnerabilities with ssvc framework.
# Export Nessus scan as CSV, then process
python3 scripts/process.py \
--input nessus_export.csv \
--format nessus \
--output ssvc_results.json
# Export OpenVAS results as XML
python3 scripts/process.py \
--input openvas_report.xml \
--format openvas \
--output ssvc_results.json
# Test SSVC decision logic with known CVEs
python3 -c "
from scripts.process import ssvc_decision
# CVE-2024-3400 - Palo Alto PAN-OS command injection (KEV listed)
assert ssvc_decision('active', 'total', 'yes', 'essential', 'material') == 'Act'
# CVE-2024-21887 - Ivanti Connect Secure (PoC available)
assert ssvc_decision('poc', 'total', 'yes', 'support', 'minimal') == 'Attend'
print('All SSVC decision tests passed')
"
| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |