Vulnerability & Threat Intelligence Lookup
Purpose
Perform unified, multi-source threat intelligence lookup for any CVE to determine:
- Real-world exploitation status: Is this vulnerability currently being actively exploited in the wild by threat actors or ransomware groups (CISA KEV)?
- Exploitation likelihood: What is the 30-day statistical probability of exploitation (FIRST EPSS)?
- Severity & Impact: What is the technical severity score (CVSS v3/v4), weakness type (CWE), and affected scope (NVD)?
- PoC Availability: Are public exploits and Proof of Concepts indexed on Exploit-DB or trending on GitHub?
This skill focuses strictly on defensive risk assessment, threat intelligence, triage prioritization, and remediation planning.
Workflow
Run the bundled read-only CLI helper from the repository root:
1. Comprehensive Threat Intel Lookup for a CVE
python vulnerability-lookup\scripts\lookup_vuln.py --cve CVE-2024-6387
2. Machine-Readable JSON Output (for Agents & Pipelines)
python vulnerability-lookup\scripts\lookup_vuln.py --cve CVE-2021-44228 --json
3. List Recent Actively Exploited Vulnerabilities (CISA KEV)
python vulnerability-lookup\scripts\lookup_vuln.py --recent-kev 10
4. Shodan Host & IP Reconnaissance (Open Ports, CVEs, Web View)
python vulnerability-lookup\scripts\lookup_vuln.py --ip 1.1.1.1
Queries Shodan InternetDB (100% free, no key required) for open ports, hostnames, and indexed CVEs, generating a direct web link (https://www.shodan.io/host/<IP>) and quick-launch browser commands.
Environment Variables (Optional)
NVD_API_KEY: Increases NIST NVD rate limit from 5 to 50 requests per 30 seconds.GITHUB_TOKEN: Increases GitHub Search API rate limit from 10 to 30 requests per minute.SHODAN_API_KEY: Enriches Shodan IP lookup with ISP, ASN, operating system, and city metadata.
Triaging & Prioritization Matrix
Correlate findings to establish defensive urgency:
| KEV Status |
EPSS Score |
CVSS Score |
Priority |
Action Guidance |
| In KEV (Active) |
Any (usually high) |
Any |
P0 - Emergency |
Active wild exploitation confirmed. Patch immediately before CISA due date or isolate systems. |
| Not in KEV |
> 30% (High) |
>= 7.0 (High/Crit) |
P1 - High |
High weaponization risk; public PoCs likely in automated scans. Fast-track patching. |
| Not in KEV |
< 10% (Low) |
>= 9.0 (Critical) |
P2 - Medium |
High theoretical impact but low current exploit activity. Follow standard patch cycle with monitoring. |
| Not in KEV |
< 5% (Low) |
< 7.0 (Low/Med) |
P3 - Routine |
Low exploitation risk and moderate impact. Routine maintenance update. |
Defensive & Remediation Guidelines
When presenting intelligence to users:
- Never download, compile, or execute exploit scripts. The presence of GitHub PoCs or Exploit-DB entries is evidence of weaponization, not an authorization to run untested exploit code.
- Highlight Ransomware Flags: If CISA KEV marks
knownRansomwareCampaignUse: Known, explicitly warn about ransomware risk.
- Verify Product Applicability: Confirm target software version matches the affected CPEs before recommending remediation.
- Link to Official Vendor Advisories: Prioritize vendor patches and mitigation guidance over third-party workarounds.
Output Contract
When queried, report:
- CVE Identifier & Query timestamp
- Threat Summary Alert (Active KEV warning, high EPSS alert, or normal notice)
- Scoring Table: CVSS score + vector, EPSS score + percentile, CISA KEV status + due date
- Technical Summary: Description, CWE weaknesses, and references
- PoC References: Exploit-DB IDs and top public GitHub PoC repos with star counts
- Recommended Action: Priority level and vendor mitigation steps
1---2name: vulnerability-lookup3description: Multi-source threat intelligence and vulnerability lookup. Query CISA KEV (active in-the-wild exploitation), FIRST EPSS (exploit probability), NIST NVD (CVSS, CWE, descriptions), Exploit-DB, and public GitHub PoC repositories for any CVE.4---56# Vulnerability & Threat Intelligence Lookup78## Purpose910Perform unified, multi-source threat intelligence lookup for any CVE to determine:111. **Real-world exploitation status:** Is this vulnerability currently being actively exploited in the wild by threat actors or ransomware groups (CISA KEV)?122. **Exploitation likelihood:** What is the 30-day statistical probability of exploitation (FIRST EPSS)?133. **Severity & Impact:** What is the technical severity score (CVSS v3/v4), weakness type (CWE), and affected scope (NVD)?144. **PoC Availability:** Are public exploits and Proof of Concepts indexed on Exploit-DB or trending on GitHub?1516This skill focuses strictly on **defensive risk assessment, threat intelligence, triage prioritization, and remediation planning**.1718---1920## Workflow2122Run the bundled read-only CLI helper from the repository root:2324### 1. Comprehensive Threat Intel Lookup for a CVE25```powershell26python vulnerability-lookup\scripts\lookup_vuln.py --cve CVE-2024-638727```2829### 2. Machine-Readable JSON Output (for Agents & Pipelines)30```powershell31python vulnerability-lookup\scripts\lookup_vuln.py --cve CVE-2021-44228 --json32```3334### 3. List Recent Actively Exploited Vulnerabilities (CISA KEV)35```powershell36python vulnerability-lookup\scripts\lookup_vuln.py --recent-kev 1037```3839### 4. Shodan Host & IP Reconnaissance (Open Ports, CVEs, Web View)40```powershell41python vulnerability-lookup\scripts\lookup_vuln.py --ip 1.1.1.142```43Queries Shodan InternetDB (100% free, no key required) for open ports, hostnames, and indexed CVEs, generating a direct web link (`https://www.shodan.io/host/<IP>`) and quick-launch browser commands.4445### Environment Variables (Optional)46- `NVD_API_KEY`: Increases NIST NVD rate limit from 5 to 50 requests per 30 seconds.47- `GITHUB_TOKEN`: Increases GitHub Search API rate limit from 10 to 30 requests per minute.48- `SHODAN_API_KEY`: Enriches Shodan IP lookup with ISP, ASN, operating system, and city metadata.4950---5152## Triaging & Prioritization Matrix5354Correlate findings to establish defensive urgency:5556| KEV Status | EPSS Score | CVSS Score | Priority | Action Guidance |57|---|---|---|---|---|58| **In KEV** (Active) | Any (usually high) | Any | **P0 - Emergency** | Active wild exploitation confirmed. Patch immediately before CISA due date or isolate systems. |59| Not in KEV | **> 30%** (High) | **>= 7.0** (High/Crit) | **P1 - High** | High weaponization risk; public PoCs likely in automated scans. Fast-track patching. |60| Not in KEV | **< 10%** (Low) | **>= 9.0** (Critical) | **P2 - Medium** | High theoretical impact but low current exploit activity. Follow standard patch cycle with monitoring. |61| Not in KEV | **< 5%** (Low) | **< 7.0** (Low/Med) | **P3 - Routine** | Low exploitation risk and moderate impact. Routine maintenance update. |6263---6465## Defensive & Remediation Guidelines6667When presenting intelligence to users:681. **Never download, compile, or execute exploit scripts.** The presence of GitHub PoCs or Exploit-DB entries is evidence of weaponization, not an authorization to run untested exploit code.692. **Highlight Ransomware Flags:** If CISA KEV marks `knownRansomwareCampaignUse: Known`, explicitly warn about ransomware risk.703. **Verify Product Applicability:** Confirm target software version matches the affected CPEs before recommending remediation.714. **Link to Official Vendor Advisories:** Prioritize vendor patches and mitigation guidance over third-party workarounds.7273---7475## Output Contract7677When queried, report:78- **CVE Identifier** & Query timestamp79- **Threat Summary Alert** (Active KEV warning, high EPSS alert, or normal notice)80- **Scoring Table:** CVSS score + vector, EPSS score + percentile, CISA KEV status + due date81- **Technical Summary:** Description, CWE weaknesses, and references82- **PoC References:** Exploit-DB IDs and top public GitHub PoC repos with star counts83- **Recommended Action:** Priority level and vendor mitigation steps
ptn1411