Vulnerability Assessment
Find and prioritize weaknesses.
Install 安装
curl -sSL https://updating.cc/skills/security/vulnerability-assessment/SKILL.md -o ~/.agents/skills/security__vulnerability-assessment/SKILL.mdSKILL.md Preview 技能内容预览
---
name: Vulnerability Assessment
description: Find and prioritize weaknesses.
---
# Vulnerability Assessment
A vulnerability assessment inventories weaknesses and prioritizes them so you fix what matters, not what's loud. Scanners find a thousand things; the skill is triage.
## Sources
- **Automated scanners.** Catch known CVEs and config errors fast. Necessary, not sufficient — they miss logic flaws.
- **Manual review.** Auth logic, business-rules abuse, complex flows. Where the real vulnerabilities often live.
- **Penetration test.** A skilled human chaining findings into exploitation. Periodic, deep.
## Prioritize (CVSS + context)
- **Exploitability.** Is there public exploit code? Is it being used in the wild?
- **Impact.** What does successful exploitation gain the attacker?
- **Exposure.** Internet-facing vs internal; auth-required vs anonymous.
- **Context.** A critical CVE on a component you don't actually use the vulnerable feature of may be low real risk.
## Output
A ranked remediation plan. The top 5 fix-now, the next 20 schedule, the long tail accept-with-justification.