# Cve Triage

> CVE lookup and triage — map discovered services/versions to known CVEs via the cve_lookup tool, score by CVSS/exploitability, and prioritize what to verify first.

- **Type:** Skill
- **Install:** `agentstack add skill-netw0rknoob-vulnclaw-cve-triage`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Netw0rkNoob](https://agentstack.voostack.com/s/netw0rknoob)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Netw0rkNoob](https://github.com/Netw0rkNoob)
- **Source:** https://github.com/Netw0rkNoob/VulnClaw/tree/main/vulnclaw/skills/specialized/cve-triage
- **Website:** https://unclecheng-li.github.io/vulnclaw.com

## Install

```sh
agentstack add skill-netw0rknoob-vulnclaw-cve-triage
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# CVE Triage

Turn version/banner evidence from recon into a prioritized, exploitability-aware
list of CVEs worth verifying. Use this after fingerprinting a service, when a
banner or `Server:` header reveals a product and version, or whenever the target
exposes software with a known version.

## The `cve_lookup` tool

VulnClaw ships a read-only `cve_lookup` tool backed by NVD:

- **Keyword search** — `cve_lookup(query="Apache httpd 2.4.49", limit=5)` returns
  the top CVEs sorted by CVSS, highest first.
- **CVE-ID detail** — `cve_lookup(query="CVE-2021-44228")` returns the full record
  plus best-effort exploit / PoC repositories discovered on GitHub.

It performs no egress to the target and is safe during recon. Without an
`NVD_API_KEY` it still works (lower rate limit); set one for heavier use.

## Workflow

1. **Extract product + version** from recon — service banners, `Server` headers,
   JS bundles, login footers, package manifests. A precise version string
   (`OpenSSH 8.2p1`, `nginx 1.18.0`) yields far better matches than a bare name.
2. **Query** `cve_lookup` with `" "`. Pull the detail record for
   any high/critical hit by re-querying its `CVE-ID`.
3. **Score & prioritize** — see `references/cve-triage-workflow.md`. Rank by CVSS,
   then by exploit availability, then by exposure (is the vulnerable surface
   actually reachable on this target?).
4. **Confirm version applicability** — match the target's version against the
   CVE's affected `cpe` range before claiming it. Banner ≠ proof of vulnerability.
5. **Record findings** with the CVE-ID, CVSS, and the evidence that maps this
   target to it. Mark unconfirmed version-only matches as needs-manual-review,
   not verified.

## Pitfalls

- A keyword match is a *hypothesis*, not a finding — version ranges and backported
  patches mean a banner version can be patched in place.
- GitHub "PoC" repos are unverified third-party code; treat as leads, never run
  blindly against a target.
- Prefer the CVSS **base** score for triage, but let exploit availability and real
  exposure override raw score when prioritizing verification effort.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Netw0rkNoob](https://github.com/Netw0rkNoob)
- **Source:** [Netw0rkNoob/VulnClaw](https://github.com/Netw0rkNoob/VulnClaw)
- **License:** MIT
- **Homepage:** https://unclecheng-li.github.io/vulnclaw.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-netw0rknoob-vulnclaw-cve-triage
- Seller: https://agentstack.voostack.com/s/netw0rknoob
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.