# Vulnerability Assessment

> Assess a specific CVE or vulnerability against the organization's technology stack. Determine exposure, severity, and remediation steps. Trigger with "assess CVE-XXXX", "are we affected by [vulnerability]", "check [CVE]", or "vulnerability impact".

- Skill: `clawpod-app/vulnerability-assessment` (Agent Skill)
- Install (CLI): `npx skillmds@latest add clawpod-app/vulnerability-assessment`
- Raw SKILL.md: https://api.skillmd.com/api/skills/clawpod-app/vulnerability-assessment/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: clawpod-app (https://skillmd.com/u/clawpod-app)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/clawpod-app/vulnerability-assessment

---


# Vulnerability Assessment

Assess a specific vulnerability's impact on the organization.

## When to Use
- New CVE announced that might affect the stack
- User asks about a specific vulnerability
- Post-incident review of exploited vulnerabilities

## Steps
1. Look up the CVE details (CVSS score, affected versions, attack vector)
2. Check against the organization's known technology stack
3. Assess exposure: is the vulnerable component deployed, internet-facing, or configured to be exploitable
4. Determine remediation: patch available, workaround, or mitigation
5. Provide clear action plan with timeline

## Output Format
```markdown
## Vulnerability Assessment -- [CVE ID]

| Field | Detail |
|-------|--------|
| **CVE** | [ID] |
| **CVSS** | [Score] / 10 |
| **Affects** | [Software and versions] |
| **Your Exposure** | [Yes/No -- which component, which environment] |
| **Exploitation** | [Active / PoC available / Theoretical] |

### Impact
[What an attacker could do if exploited]

### Remediation
1. [Primary fix -- patch version]
2. [Workaround if patch not immediate]
3. [Monitoring steps while unpatched]

### Timeline
- **Immediate**: [What to do now]
- **This Week**: [Scheduled remediation]
- **Ongoing**: [Verification and monitoring]
```