How do I install the Reporting Cvss Scoring skill?

Run npx skillmds@latest add noorqureshi/reporting-cvss-scoring in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Reporting Cvss Scoring safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Reporting Cvss Scoring?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Reporting Cvss Scoring free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Reporting Cvss Scoring?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Reporting Cvss Scoring by noorqureshi

Name: Reporting Cvss Scoring
Author: NoorQureshi

Reporting Cvss Scoring

Assign a defensible severity to a finding — build the CVSS 3.1 vector from demonstrated impact and reconcile it with the program's own scale. Load on "what severity", "CVSS", "rate this bug", or before submitting a report. Signals: a confirmed finding needing a score, a program VRT/severity policy, a severity dispute.

NoorQureshi b09080a 2.6 KB Updated Sep 17, 2026

File contents

Severity & CVSS scoring

When it applies

A finding is reproduced and you must put a number on it — for a report, a dispute, or triage. A defensible score gets paid/prioritised fairly; an inflated one gets you closed as N/A and hurts your credibility.

Why it works

CVSS decomposes severity into metrics you justify one at a time from what you proved, not what's theoretically possible. Grounding each metric in demonstrated impact makes the score arguable and consistent, and mapping it to the program's scale turns it into the right payout/priority.

Method

Score from demonstrated impact, metric by metric (CVSS 3.1 Base):
- AV (Attack Vector): Network for a remote web bug, down to Physical.
- AC/PR/UI: was it reliable (low complexity)? did it need auth (privileges)? did it need a victim action (user interaction)? Set from what your PoC actually required.
- S (Scope): Changed if the bug crosses a trust/authority boundary (e.g. SSRF into internal services, sandbox escape) — a big multiplier, so justify it.
- C/I/A: rate confidentiality/integrity/availability from what you demonstrated, not the worst imaginable.
Produce the vector + score with the FIRST calculator (e.g. AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Reconcile with the program: map to Bugcrowd's VRT or the program's severity matrix — the program's policy is the ruling, CVSS is the starting point (tradecraft-bugbounty-platforms).
Write the one-line justification for any contested metric (usually Scope and PR).

Gotchas

Don't claim Critical for a self-XSS, a bug needing implausible preconditions, or theoretical impact you didn't show — inflation gets you downgraded and distrusted.
Scope:Changed is the most abused metric — only when a real authority boundary is crossed.
A chain can score higher than any single bug; score the demonstrated chain (exploit-chaining).
CVSS ignores business context; the program's own scale (or a pentest's risk rating) may override.

Verify success

You have a CVSS vector whose every metric you can defend from your PoC, plus the program-scale severity it maps to — and it survives a sceptical triager.

References

FIRST CVSS 3.1 specification & calculator; Bugcrowd VRT; program severity policies.

---name: reporting-cvss-scoringdescription: Assign a defensible severity to a finding — build the CVSS 3.1 vector from demonstrated impact and reconcile it with the program's own scale. Load on "what severity", "CVSS", "rate this bug", or before submitting a report. Signals: a confirmed finding needing a score, a program VRT/severity policy, a severity dispute.---# Severity & CVSS scoring## When it appliesA finding is reproduced and you must put a number on it — for a report, a dispute, or triage. Adefensible score gets paid/prioritised fairly; an inflated one gets you closed as N/A and hurts yourcredibility.## Why it worksCVSS decomposes severity into metrics you justify one at a time from what you *proved*, not what'stheoretically possible. Grounding each metric in demonstrated impact makes the score arguable andconsistent, and mapping it to the program's scale turns it into the right payout/priority.## Method1. **Score from demonstrated impact**, metric by metric (CVSS 3.1 Base): - **AV** (Attack Vector): Network for a remote web bug, down to Physical. - **AC/PR/UI**: was it reliable (low complexity)? did it need auth (privileges)? did it need a victim action (user interaction)? Set from what your PoC actually required. - **S** (Scope): Changed if the bug crosses a trust/authority boundary (e.g. SSRF into internal services, sandbox escape) — a big multiplier, so justify it. - **C/I/A**: rate confidentiality/integrity/availability from what you demonstrated, not the worst imaginable.2. **Produce the vector + score** with the FIRST calculator (e.g. `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`).3. **Reconcile with the program**: map to Bugcrowd's VRT or the program's severity matrix — the program's policy is the ruling, CVSS is the starting point (`tradecraft-bugbounty-platforms`).4. **Write the one-line justification** for any contested metric (usually Scope and PR).## Gotchas- Don't claim Critical for a self-XSS, a bug needing implausible preconditions, or theoretical impact you didn't show — inflation gets you downgraded and distrusted.- Scope:Changed is the most abused metric — only when a real authority boundary is crossed.- A **chain** can score higher than any single bug; score the demonstrated chain (`exploit-chaining`).- CVSS ignores business context; the program's own scale (or a pentest's risk rating) may override.## Verify successYou have a CVSS vector whose every metric you can defend from your PoC, plus the program-scaleseverity it maps to — and it survives a sceptical triager.## ReferencesFIRST CVSS 3.1 specification & calculator; Bugcrowd VRT; program severity policies.

Frequently asked questions