CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/cve-exploitability-triage

Ranks known CVE findings by real-world exploitability instead of severity alone: enriches each CVE with its EPSS probability (the chance exploitation activity is observed in the next 30 days) and CISA KEV membership (confirmed exploited in the wild), applies OpenVEX status assertions to set aside vulnerabilities the product is not affected by, applies a reachability heuristic for vulnerable code that is never called, and assigns every finding to one of four buckets (Fix-Now, Fix-This-Sprint, Fix-Backlog, Accept-Risk) using documented EPSS thresholds. Treats a CISA KEV listing as non-waivable under any justification. Use when a dependency, container image, or SBOM vulnerability scan has produced more CVEs than the team can fix in the available window and someone has to decide which ones get fixed first and which can wait.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable code and a clearly sequenced, validated workflow, plus clean single-file organization. Its only weakness is conciseness: several justification and rationale passages are longer than necessary and some points are restated across sections.

Suggestions

Tighten Step 7's waiver-argument table and the 'Why these two EPSS numbers' rationale to the essential rule, removing prose that restates points already made in earlier steps.

Trim the Anti-patterns table entries that merely restate a step's existing guidance, keeping only anti-patterns that add a new failure mode not already covered inline.

Consider moving the lengthy CVSS/EPSS background quotes (Steps 2-3) into a short reference note so the operational steps read leaner while preserving the citations.

DimensionReasoningScore

Conciseness

The body is dense with executable commands and genuine domain specifics Claude would not reliably know, but lengthy justification prose (Step 7's waiver-argument table, the 'Why these two EPSS numbers' section) and restated points in the Anti-patterns table could be tightened, matching the score-2 'mostly efficient but could be tightened' anchor rather than the fully lean score-3.

2 / 3

Actionability

Provides fully executable curl/jq commands, a runnable Python priority() and apply_vex() function, and documented EPSS gate thresholds (0.5, 0.3), matching the score-3 copy-paste-ready anchor rather than the pseudocode/incomplete score-2.

3 / 3

Workflow Clarity

A clearly sequenced 7-step process with explicit validation checkpoints (reject unjustified not_affected, record signal snapshot dates, record which reachability tool was used) and a worked example walking the bucket logic branch-by-branch, matching the score-3 anchor; checkpoints are explicit, not the implicit ones of score-2.

3 / 3

Progressive Disclosure

No bundle files exist and none are referenced (the URLs point to live data feeds, not bundle files); the single file is well-organized into clearly signaled sections (Steps 1-7, Worked example, Expected output, Anti-patterns, Limitations) with internal cross-references, satisfying the well-organized-sections criterion for progressive disclosure at score-3.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific, third-person, and explicitly states both what it does and when to use it with natural trigger phrases. It is a strong, distinctive description with no over-claims or fluff.

DimensionReasoningScore

Specificity

Lists many concrete actions ('enriches each CVE with its EPSS probability', 'CISA KEV membership', 'applies OpenVEX status assertions', 'applies a reachability heuristic', 'assigns every finding to one of four buckets'), matching the score-3 anchor of multiple specific concrete actions rather than the vague/abstract score-1 or partially-named score-2.

3 / 3

Completeness

Explicitly answers what it does (ranks/enriches/buckets CVEs) and when via a concrete 'Use when...' clause with specific triggers, matching the score-3 anchor; the 'when' is explicit, not merely implied as in score-2.

3 / 3

Trigger Term Quality

Includes natural phrases a triager would actually say ('dependency, container image, or SBOM vulnerability scan', 'more CVEs than the team can fix', 'decide which ones get fixed first'), giving good coverage of realistic trigger terms rather than jargon-only or partial variations.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear niche (CVE exploitability triage via EPSS/KEV/VEX/reachability) with specific triggers unlikely to fire for unrelated skills, matching the score-3 clear-niche anchor rather than the overlapping score-2 or generic score-1.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents