Vulnerability Analysis

Use this skill when the user asks for detailed vulnerability analysis beyond basic CVE lookup.

When to Use

• User asks "how serious is this vulnerability?"
• User asks about exploit availability or PoC code
• User wants to understand impact on their specific infrastructure
• User asks about mitigation or remediation steps
• User wants to prioritize which vulnerabilities to fix first

Workflow

1. Gather Vulnerability Data

Start with built-in OASM tools to get workspace context:

Tool	Purpose
discover_vulnerabilities	List vulns matching a query (e.g., "CVE-2024", "XSS")
investigate_vulnerability	Get full details on a specific vulnerability by ID
enumerate_assets	Find assets that may run affected software
fingerprint_technologies	Identify technologies in use to check exposure
list_network_ports	Check if vulnerable services are exposed
enumerate_open_issues	See if the vulnerability is already tracked

2. Enrich with External Sources

For deeper analysis, use retrieve_web_page to fetch from these sources:

CVE Details:

• Trickest CVE: https://raw.githubusercontent.com/trickest/cve/refs/heads/main/{YEAR}/CVE-{YEAR}-{NUMBER}.md
• NVD API: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-{YEAR}-{NUMBER}

Exploit Intelligence:

• GitHub PoC search: https://github.com/nomi-sec/PoC-in-GitHub
• Exploit-DB: https://www.exploit-db.com/search
• Metasploit modules: https://www.rapid7.com/db/modules/

Vendor Advisories:

• Microsoft MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-{YEAR}-{NUMBER}
• Apache security: https://lists.apache.org/thread/

3. Analyze the Vulnerability

For each vulnerability, evaluate these dimensions:

Severity Assessment

• CVSS v3.1 base score and vector string
• EPSS (Exploit Prediction Scoring System) if available
• CISA KEV (Known Exploited Vulnerabilities) catalog status
• Contextual severity: is the affected component internet-facing?

Exploit Maturity

Categorize the exploit status:

• None: No known exploits
• PoC: Proof-of-concept code exists (GitHub, write-ups)
• Functional: Exploit works reliably but not mass-deployed
• Weaponized: Used in real attacks, available in exploit frameworks

Affected Scope

• List affected products and versions from the CVE
• Cross-reference with workspace assets using enumerate_assets and fingerprint_technologies
• Determine exposure: internet-facing vs internal-only

Remediation Guidance

• Patch availability and version
• Workarounds if no patch exists (WAF rules, network segmentation, disable feature)
• Priority level:
  • Immediate: Exploited in the wild (check CISA KEV)
  • High: Functional exploit or PoC available
  • Medium: Vulnerable but no known exploit
  • Low: Informational or low-impact

4. Present Findings

Structure your analysis as:

**Summary**: One-line overview of the vulnerability

**Severity**: CVSS score + vector + EPSS (if available)

**Exploit Status**: None / PoC / Functional / Weaponized

**Affected Assets**: X assets in your workspace match
- asset1.example.com (nginx 1.18)
- asset2.example.com (Apache 2.4.49)

**Impact**: What an attacker can achieve (e.g., RCE, data leak, DoS)

**Remediation**: Specific steps with version numbers
- Upgrade to X.Y.Z or later
- Temporary: apply WAF rule / disable feature

**Priority**: Immediate / High / Medium / Low

5. Track the Issue

After analysis:

• If no existing issue, suggest creating one via the Issues system
• Store key findings in stm_write for reference during the conversation
• Use ltm_append to persist critical vulnerability intelligence for the workspace