New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Triaging Vulnerabilities With Ssvc Framework

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS…

Apache-2.0Auto-check passedSecurity

Install Triaging Vulnerabilities With Ssvc Framework

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-vulnerabilities-with-ssvc-framework -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills triaging-vulnerabilities-with-ssvc-framework --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/triaging-vulnerabilities-with-ssvc-framework .claude/skills/triaging-vulnerabilities-with-ssvc-framework && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
triaging-vulnerabilities-with-ssvc-framework
GitHub stars
34k
Token cost
~1.9k tokens
SKILL.md length
387 words
Files
7 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS…

  • Works in 9 steps: Exploitation Status → Technical Impact → Automatability → …
  • Prioritizing vulnerability scan results (OpenVAS
  • SKILL.md covers Overview, When to Use, Prerequisites and SSVC Decision Points, plus 5 more sections
  • Runs Python scripts from its folder; calls python3 and curl; reaches cisa.gov and api.first.org

What it does

Triaging Vulnerabilities With Ssvc Framework is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track/Track/Attend/Act decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.

Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. The skill folder holds 8 other files, including scripts and reference files (for example `references/api-reference.md`, `references/standards.md` and `references/workflows.md`).

It sits in Security, covering Penetration testing. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Prioritizing vulnerability scan results (OpenVAS
  • Qualys) for remediation planning beyond raw CVSS scores

Example prompts

  • “Use the triaging-vulnerabilities-with-ssvc-framework skill to triage and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability…”
  • “/triaging-vulnerabilities-with-ssvc-framework”

Requirements

  • Python 3

Workflow steps

9 steps, taken from the step headings in SKILL.md.

  1. Exploitation Status
  2. Technical Impact
  3. Automatability
  4. Mission Prevalence
  5. Public Well-Being Impact
  6. Ingest Vulnerability Data
  7. Evaluate Each Decision Point
  8. Apply SSVC Decision Tree
  9. Generate Triage Report

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • python3
    • curl

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • cisa.gov
    • api.first.org

    Also links to:

    • certcc.github.io
    • first.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Triaging Vulnerabilities With Ssvc Framework loads about 1.9k tokens when it runs, and up to ~4.4k if it reads all its reference files. Until then it costs about 118 tokens; SKILL.md has 387 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~118
When it runs · the whole SKILL.md, loaded when a task matches
~1.9k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 387 words, ~1,942 tokens.

Download SKILL.mdSave it as .claude/skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md (or your agent's skills folder). This skill also uses 6 other files; get the full folder from GitHub.
name
triaging-vulnerabilities-with-ssvc-framework
description
Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track/Track*/Attend/Act decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.
domain
cybersecurity
subdomain
vulnerability-management
tags
ssvc, vulnerability-triage, cisa, vulnerability-prioritization, decision-tree, cvss, remediation, risk-management
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
ID.RA-01, ID.RA-02, ID.IM-02, ID.RA-06
mitre_attack
T1190, T1203, T1068

Triaging Vulnerabilities with SSVC Framework

Overview

The Stakeholder-Specific Vulnerability Categorization (SSVC) framework, developed by Carnegie Mellon University's Software Engineering Institute (SEI) in collaboration with CISA, provides a structured decision-tree methodology for vulnerability prioritization. Unlike CVSS alone, SSVC accounts for exploitation status, technical impact, automatability, mission prevalence, and public well-being impact to produce one of four actionable outcomes: Track, Track*, Attend, or Act.

When to Use

  • When managing security operations that require triaging vulnerabilities with ssvc framework
  • When improving security program maturity and operational processes
  • When establishing standardized procedures for security team workflows
  • When integrating threat intelligence or vulnerability data into operations

Prerequisites

  • Python 3.9+ with requests, pandas, and jinja2 libraries
  • Access to CISA KEV catalog API and EPSS API from FIRST
  • NVD API key (optional, for higher rate limits)
  • Vulnerability scan results from tools like OpenVAS, Nessus, or Qualys

SSVC Decision Points

1. Exploitation Status

Assess current exploitation activity:

  • None - No evidence of active exploitation
  • PoC - Proof-of-concept exists publicly
  • Active - Active exploitation observed in the wild (check CISA KEV)
bash
# Check if a CVE is in CISA Known Exploited Vulnerabilities catalog
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
  python3 -c "import sys,json; data=json.load(sys.stdin); cves=[v['cveID'] for v in data['vulnerabilities']]; print('Active' if 'CVE-2024-3400' in cves else 'Check PoC/None')"
2. Technical Impact

Determine scope of compromise if exploited:

  • Partial - Limited to a subset of system functionality or data
  • Total - Full control of the affected system, complete data access
3. Automatability

Evaluate if exploitation can be automated at scale:

  • No - Requires manual, targeted exploitation per victim
  • Yes - Can be scripted or worm-like propagation is possible
Show full SKILL.md (163 more words)Show less
4. Mission Prevalence

How widespread is the affected product in your environment:

  • Minimal - Limited deployment, non-critical systems
  • Support - Supports mission-critical functions indirectly
  • Essential - Directly enables core mission capabilities
5. Public Well-Being Impact

Potential consequences for physical safety and public welfare:

  • Minimal - Negligible impact on safety or public services
  • Material - Noticeable degradation of public services
  • Irreversible - Loss of life, major property damage, or critical infrastructure failure

SSVC Decision Outcomes

OutcomeAction RequiredSLA
TrackMonitor, remediate in normal patch cycle90 days
Track*Monitor closely, prioritize in next patch window60 days
AttendEscalate to senior management, accelerate remediation14 days
ActApply mitigations immediately, executive-level awareness48 hours

Workflow

Step 1: Ingest Vulnerability Data
python
import requests
import json

# Fetch CISA KEV catalog
kev_url = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
kev_data = requests.get(kev_url).json()
kev_cves = {v['cveID'] for v in kev_data['vulnerabilities']}

# Fetch EPSS scores for context
epss_url = "https://api.first.org/data/v1/epss"
epss_response = requests.get(epss_url, params={"cve": "CVE-2024-3400"}).json()
Step 2: Evaluate Each Decision Point
python
def evaluate_exploitation(cve_id, kev_set):
    """Determine exploitation status from CISA KEV and EPSS data."""
    if cve_id in kev_set:
        return "active"
    epss = requests.get(
        "https://api.first.org/data/v1/epss",
        params={"cve": cve_id}
    ).json()
    if epss.get("data"):
        score = float(epss["data"][0].get("epss", 0))
        if score > 0.5:
            return "poc"
    return "none"

def evaluate_technical_impact(cvss_vector):
    """Parse CVSS vector for scope and impact metrics."""
    if "S:C" in cvss_vector or "C:H/I:H/A:H" in cvss_vector:
        return "total"
    return "partial"

def evaluate_automatability(cvss_vector, cve_description):
    """Check if attack vector is network-based with low complexity."""
    if "AV:N" in cvss_vector and "AC:L" in cvss_vector and "UI:N" in cvss_vector:
        return "yes"
    return "no"
Step 3: Apply SSVC Decision Tree
python
def ssvc_decision(exploitation, tech_impact, automatability, mission_prevalence, public_wellbeing):
    """CISA SSVC decision tree implementation."""
    if exploitation == "active":
        if tech_impact == "total" or automatability == "yes":
            return "Act"
        if mission_prevalence in ("essential", "support"):
            return "Act"
        return "Attend"
    if exploitation == "poc":
        if automatability == "yes" and tech_impact == "total":
            return "Attend"
        if mission_prevalence == "essential":
            return "Attend"
        return "Track*"
    # exploitation == "none"
    if tech_impact == "total" and mission_prevalence == "essential":
        return "Track*"
    return "Track"
Step 4: Generate Triage Report
bash
# Run the SSVC triage script against scan results
python3 scripts/process.py --input scan_results.csv --output ssvc_triage_report.json

# View summary
cat ssvc_triage_report.json | python3 -m json.tool | head -50

Integration with Vulnerability Scanners

Import from Nessus CSV
bash
# Export Nessus scan as CSV, then process
python3 scripts/process.py \
  --input nessus_export.csv \
  --format nessus \
  --output ssvc_results.json
Import from OpenVAS
bash
# Export OpenVAS results as XML
python3 scripts/process.py \
  --input openvas_report.xml \
  --format openvas \
  --output ssvc_results.json

Validation and Testing

bash
# Test SSVC decision logic with known CVEs
python3 -c "
from scripts.process import ssvc_decision
# CVE-2024-3400 - Palo Alto PAN-OS command injection (KEV listed)
assert ssvc_decision('active', 'total', 'yes', 'essential', 'material') == 'Act'
# CVE-2024-21887 - Ivanti Connect Secure (PoC available)
assert ssvc_decision('poc', 'total', 'yes', 'support', 'minimal') == 'Attend'
print('All SSVC decision tests passed')
"

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files (scripts, references) in skills/triaging-vulnerabilities-with-ssvc-framework of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Triaging Vulnerabilities With Ssvc Framework next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Triaging Vulnerabilities With Ssvc Framework compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Triaging Vulnerabilities With Ssvc Framework this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.9kAutomated safety check: PassApache-2.0
Strix Code Vulnerability Scanusestrix/strix68k—~1.1kAutomated safety check: PassApache-2.0
Code Audit3stoneBrother/code-audit8921 repos~2.7kAutomated safety check: PassNone
Fix Strix Security Findingsusestrix/strix68k—~1.5kAutomated safety check: PassApache-2.0
Metabigor OSINT Reconj3ssie/metabigor1.9k—~2.4kAutomated safety check: PassMIT
Wooyun Legacytanweai/wooyun-legacy1.8k—~1.9kAutomated safety check: PassCustom licence

Similar skills

  • Strix Code Vulnerability Scan

    usestrix/strix

    Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.

    68k GitHub stars~1.1k tokensUpdated today
    SecurityAuto-check passed

  • Code Audit

    3stoneBrother/code-audit

    Professional code security audit skill covering 55+ vulnerability types.

    892 GitHub starsUsed in 1 repo~2.7k tokens
    SecurityAuto-check passed

  • Fix Strix Security Findings

    usestrix/strix

    Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.

    68k GitHub stars~1.5k tokensUpdated today
    SecurityAuto-check passed

  • Metabigor OSINT Recon

    j3ssie/metabigor

    Operates the metabigor CLI to map a target's network ranges, subdomains, ports, related domains, CDNs and archived URLs from free sources without API keys.

    1.9k GitHub stars~2.4k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Wooyun Legacy

    tanweai/wooyun-legacy

    WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…

    1.8k GitHub stars~1.9k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • OWASP Top 10 Testing with Strix

    usestrix/strix

    Runs Strix's autonomous exploit agents against each OWASP Top 10:2025 category and the API Security Top 10, reporting only what could actually be proven with a proof-of-concept.

    68k GitHub stars~1.6k tokensUpdated today
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Triaging Vulnerabilities With Ssvc Framework

What does Triaging Vulnerabilities With Ssvc Framework do?

Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS…. Triaging Vulnerabilities With Ssvc Framework is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track/Track/Attend/Act decisions.

When should I use Triaging Vulnerabilities With Ssvc Framework?

Triaging Vulnerabilities With Ssvc Framework fits situations like: prioritizing vulnerability scan results (OpenVAS; qualys) for remediation planning beyond raw CVSS scores.

How do I install Triaging Vulnerabilities With Ssvc Framework in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-vulnerabilities-with-ssvc-framework -a claude-code`. Or copy the skill folder (skills/triaging-vulnerabilities-with-ssvc-framework in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/triaging-vulnerabilities-with-ssvc-framework in your project. Claude Code loads it when a task matches its description.

How do I install Triaging Vulnerabilities With Ssvc Framework in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-vulnerabilities-with-ssvc-framework -a codex`. Or copy the skill folder (skills/triaging-vulnerabilities-with-ssvc-framework in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/triaging-vulnerabilities-with-ssvc-framework in your project. Codex loads it when a task matches its description.

Can I use Triaging Vulnerabilities With Ssvc Framework in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-vulnerabilities-with-ssvc-framework -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/triaging-vulnerabilities-with-ssvc-framework, .gemini/skills/triaging-vulnerabilities-with-ssvc-framework, .github/skills/triaging-vulnerabilities-with-ssvc-framework and .opencode/skills/triaging-vulnerabilities-with-ssvc-framework in your project.

What does Triaging Vulnerabilities With Ssvc Framework need to run?

Going by SKILL.md and its folder, Triaging Vulnerabilities With Ssvc Framework needs Python for the scripts in its folder and the command-line tools its instructions call (python3 and curl). Our summary lists: Python 3.

Does Triaging Vulnerabilities With Ssvc Framework access the network?

SKILL.md names 4 domains. In commands or code: cisa.gov and api.first.org; the agent is likely to contact these when it follows the instructions. As links in the text: certcc.github.io and first.org. This is read from the text; nothing was executed.

Is Triaging Vulnerabilities With Ssvc Framework safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Triaging Vulnerabilities With Ssvc Framework use?

Triaging Vulnerabilities With Ssvc Framework is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Triaging Vulnerabilities With Ssvc Framework use?

About 1.9k tokens (SKILL.md is roughly 7.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.5k tokens, read only when the agent opens those files.

What are the alternatives to Triaging Vulnerabilities With Ssvc Framework?

Skills that share tags, products or a category with Triaging Vulnerabilities With Ssvc Framework: Strix Code Vulnerability Scan (usestrix/strix, 68k stars), Code Audit (3stoneBrother/code-audit, 892 stars), Fix Strix Security Findings (usestrix/strix, 68k stars) and Metabigor OSINT Recon (j3ssie/metabigor, 1.9k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Triaging Vulnerabilities With Ssvc Framework?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.