# Vulnerability Lookup

> Multi-source threat intelligence and vulnerability lookup. Query CISA KEV (active in-the-wild exploitation), FIRST EPSS (exploit probability), NIST NVD (CVSS, CWE, descriptions), Exploit-DB, and public GitHub PoC repositories for any CVE.

- Skill: `ptn1411/vulnerability-lookup` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add ptn1411/vulnerability-lookup`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ptn1411/vulnerability-lookup/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ptn1411 (https://skillmd.com/u/ptn1411)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ptn1411/vulnerability-lookup

---


# Vulnerability & Threat Intelligence Lookup

## Purpose

Perform unified, multi-source threat intelligence lookup for any CVE to determine:
1. **Real-world exploitation status:** Is this vulnerability currently being actively exploited in the wild by threat actors or ransomware groups (CISA KEV)?
2. **Exploitation likelihood:** What is the 30-day statistical probability of exploitation (FIRST EPSS)?
3. **Severity & Impact:** What is the technical severity score (CVSS v3/v4), weakness type (CWE), and affected scope (NVD)?
4. **PoC Availability:** Are public exploits and Proof of Concepts indexed on Exploit-DB or trending on GitHub?

This skill focuses strictly on **defensive risk assessment, threat intelligence, triage prioritization, and remediation planning**.

---

## Workflow

Run the bundled read-only CLI helper from the repository root:

### 1. Comprehensive Threat Intel Lookup for a CVE
```powershell
python vulnerability-lookup\scripts\lookup_vuln.py --cve CVE-2024-6387
```

### 2. Machine-Readable JSON Output (for Agents & Pipelines)
```powershell
python vulnerability-lookup\scripts\lookup_vuln.py --cve CVE-2021-44228 --json
```

### 3. List Recent Actively Exploited Vulnerabilities (CISA KEV)
```powershell
python vulnerability-lookup\scripts\lookup_vuln.py --recent-kev 10
```

### 4. Shodan Host & IP Reconnaissance (Open Ports, CVEs, Web View)
```powershell
python vulnerability-lookup\scripts\lookup_vuln.py --ip 1.1.1.1
```
Queries Shodan InternetDB (100% free, no key required) for open ports, hostnames, and indexed CVEs, generating a direct web link (`https://www.shodan.io/host/<IP>`) and quick-launch browser commands.

### Environment Variables (Optional)
- `NVD_API_KEY`: Increases NIST NVD rate limit from 5 to 50 requests per 30 seconds.
- `GITHUB_TOKEN`: Increases GitHub Search API rate limit from 10 to 30 requests per minute.
- `SHODAN_API_KEY`: Enriches Shodan IP lookup with ISP, ASN, operating system, and city metadata.

---

## Triaging & Prioritization Matrix

Correlate findings to establish defensive urgency:

| KEV Status | EPSS Score | CVSS Score | Priority | Action Guidance |
|---|---|---|---|---|
| **In KEV** (Active) | Any (usually high) | Any | **P0 - Emergency** | Active wild exploitation confirmed. Patch immediately before CISA due date or isolate systems. |
| Not in KEV | **> 30%** (High) | **>= 7.0** (High/Crit) | **P1 - High** | High weaponization risk; public PoCs likely in automated scans. Fast-track patching. |
| Not in KEV | **< 10%** (Low) | **>= 9.0** (Critical) | **P2 - Medium** | High theoretical impact but low current exploit activity. Follow standard patch cycle with monitoring. |
| Not in KEV | **< 5%** (Low) | **< 7.0** (Low/Med) | **P3 - Routine** | Low exploitation risk and moderate impact. Routine maintenance update. |

---

## Defensive & Remediation Guidelines

When presenting intelligence to users:
1. **Never download, compile, or execute exploit scripts.** The presence of GitHub PoCs or Exploit-DB entries is evidence of weaponization, not an authorization to run untested exploit code.
2. **Highlight Ransomware Flags:** If CISA KEV marks `knownRansomwareCampaignUse: Known`, explicitly warn about ransomware risk.
3. **Verify Product Applicability:** Confirm target software version matches the affected CPEs before recommending remediation.
4. **Link to Official Vendor Advisories:** Prioritize vendor patches and mitigation guidance over third-party workarounds.

---

## Output Contract

When queried, report:
- **CVE Identifier** & Query timestamp
- **Threat Summary Alert** (Active KEV warning, high EPSS alert, or normal notice)
- **Scoring Table:** CVSS score + vector, EPSS score + percentile, CISA KEV status + due date
- **Technical Summary:** Description, CWE weaknesses, and references
- **PoC References:** Exploit-DB IDs and top public GitHub PoC repos with star counts
- **Recommended Action:** Priority level and vendor mitigation steps