CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/cve-exploitability-triage

Ranks known CVE findings by real-world exploitability instead of severity alone: enriches each CVE with its EPSS probability (the chance exploitation activity is observed in the next 30 days) and CISA KEV membership (confirmed exploited in the wild), applies OpenVEX status assertions to set aside vulnerabilities the product is not affected by, applies a reachability heuristic for vulnerable code that is never called, and assigns every finding to one of four buckets (Fix-Now, Fix-This-Sprint, Fix-Backlog, Accept-Risk) using documented EPSS thresholds. Treats a CISA KEV listing as non-waivable under any justification. Use when a dependency, container image, or SBOM vulnerability scan has produced more CVEs than the team can fix in the available window and someone has to decide which ones get fixed first and which can wait.

69

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable triage skill with executable code, a clear step sequence, and strong internal validation logic. Its main weakness is length: it re-explains familiar concepts and keeps all material inline in one large file.

Suggestions

Tighten the concept-explanation prose in the 'three signals' section — the CVSS bands table, the EPSS-misreading paragraph, and the quoted KEV criteria — to only the definitions the bucketing logic depends on, since Claude already knows CVSS/EPSS/KEV basics.

Consider moving the worked example and/or the expected output template into a referenced file (e.g. EXAMPLE.md) to reduce the SKILL.md footprint while keeping the step sequence as the overview.

Add an explicit post-bucketing verification checkpoint (e.g. 'confirm every Fix-Now entry records its triggering rule and signal dates') to close the minor workflow-clarity validation gap for this batch operation.

DimensionReasoningScore

Conciseness

The body is mostly substantive operational detail, but it re-explains concepts Claude already knows (CVSS qualitative bands, the EPSS definition, KEV inclusion criteria) with quoted prose that could be tightened to only the precise definitions the bucketing depends on.

3 / 5

Actionability

Fully executable throughout — curl/jq commands with real endpoints and column names, a TypeScript TriageInput interface, and copy-paste-ready apply_vex and priority functions, plus a worked example and an output template.

5 / 5

Workflow Clarity

A clearly sequenced seven-step pipeline with embedded validation (reject unjustified not_affected VEX, never zero a missing EPSS, record snapshot dates for reproducibility) and a full walk-through; minor gap is the absence of an explicit post-bucketing verification checkpoint.

4 / 5

Progressive Disclosure

Well-organized single file with clear step headers, a worked example, and no nested references, but at roughly 500 lines it is monolithic with no content split out to reference files.

4 / 5

Total

16

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, precise description that covers concrete capabilities, explicit trigger conditions, and a distinct niche in third-person voice. It is longer than typical but earns its length with specificity rather than fluff.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'enriches each CVE with its EPSS probability', 'CISA KEV membership', 'applies OpenVEX status assertions', 'applies a reachability heuristic', 'assigns every finding to one of four buckets' — giving comprehensive coverage of what the skill does.

5 / 5

Completeness

Explicitly answers both 'what' (ranks by exploitability via EPSS/KEV/VEX/reachability and four named buckets) and 'when' ('Use when a dependency, container image, or SBOM vulnerability scan has produced more CVEs than the team can fix in the available window').

5 / 5

Trigger Term Quality

Strong natural terms a user would say ('CVE', 'vulnerability scan', 'SBOM', 'dependency', 'container image', 'more CVEs than the team can fix'); a few synonyms like 'vulnerability report' or 'security findings' are absent, and file extensions are not applicable to this domain.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (exploitability-based CVE triage with EPSS/KEV/VEX/reachability) with distinct triggers and minimal overlap risk; the body even names a sibling skill for the separate scanner-merge task.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents