VT
Vulnerability Triage
🔵 Stable🕐 updated 2026-07-01
🔷 SkillSpec L3
pm-security
Triage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red.
What to give it
▸The finding — the CVE/scanner/pentest item: what it is, affected component/version, CVSS if given.
▸Your context — is the affected component reachable (internet-facing? authenticated-only? internal?), what data/privilege it touches, compensating controls in place.
▸Exploit status — is there a known public exploit / is it being exploited in the wild (e.g. on CISA KEV)?
▸Environment — prod vs. non-prod, blast radius, business criticality.
✅ The bar it holds itself to
Every skill in this library self-verifies — these are this skill's own quality checks, straight from its definition.
✓Severity is assessed in context (exposure, exploitability, compensating controls) — not just the raw CVSS/scanner color
✓Exploitability covers reachability, preconditions, and public/in-the-wild exploit status
✓Both a real fix and an interim mitigation (if not immediately patchable) are given
✓A fix-by SLA is assigned proportional to the contextual severity
✓Verification and any monitoring/detection follow-ups are noted
⚠️ What it refuses to do
Do not treat the scanner's rating as the answer — adjust for reachability and real impact
Do not ignore exploit status — a known-exploited (KEV) bug jumps the queue regardless of score
Do not give only "patch it" with no interim mitigation when patching will take time
Do not assign a generic SLA — tie urgency to the contextual severity
Do not triage assets you don't own or aren't authorized to assess
Install
npx pm-claude-skills add --agent claude # or codex · cursor · gemini · hermes
# or one-line MCP (every skill, any client):
claude mcp add pm-skills -- npx -y pm-claude-skills-mcpRelated skills
🔌 Embed this skill
Drop this on your blog, docs, or site — it renders a "Run this skill" card:
<div data-pm-skill="vuln-triage"></div>
<script src="https://mohitagw15856.github.io/pm-claude-skills/embed.js" async></script>💬 Discussion
Vulnerability Triage is one of 750 open-source professional AI agent skills — all SkillSpec L3.
Try them all in the browser · ⭐ Star on GitHub · Browse the full catalog