# Securin Cve Enrichment

> Use this skill when the user asks to "enrich this CVE", "tell me about CVE-XXXX", "what's the threat intel on this vulnerability", "look up this CVE", "is this CVE exploited in the wild", "CISA KEV status of...", or wants a global intelligence report on a specific vulnerability from Securin Core — independent of their environment. For "am I affected by this CVE" use securin-threat-correlation instead. Requires the Securin Platform MCP server.

- Skill: `securin-public/securin-cve-enrichment` (Agent Skill, multi-file: 20 files)
- Install (CLI): `npx skillmds@latest add securin-public/securin-cve-enrichment`
- Raw SKILL.md: https://api.skillmd.com/api/skills/securin-public/securin-cve-enrichment/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: securin-public (https://skillmd.com/u/securin-public)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/securin-public/securin-cve-enrichment

---


# CVE Enrichment (Securin Core)

## Purpose

Produce a complete **global** intelligence picture for a specific CVE or vulnerability — sourced from Securin Core's vulnerability & threat intelligence indices. This skill is about the vulnerability itself (severity, exploitation, threat actor attribution, affected products) and does **not** query the user's environment.

Pair skills:
- **"Am I affected by this?"** → use `securin-threat-correlation`.
- **"How do I fix it?"** → use `securin-remediation-guidance`.

## When to use

- "Enrich CVE-2024-3400"
- "Tell me everything about this CVE"
- "Is this vulnerability being exploited?"
- "What's the CISA KEV status of…"
- "Who's exploiting CVE-XXXX?" (via `searchThreatActorData` + `riskIndex.contributingFactors[]`)
- "What ransomware families use this CVE?" (via `riskIndex.contributingFactors[]` commentary + web search)

## Pre-flight

### Step 0 — Account preflight (CC-1)

See [_shared/account-preflight.md](references/_shared/account-preflight.md). Even though this skill queries the global Core indices (not account-scoped data), the preflight still runs so that deep links (CC-2) and any cross-referenced environment data use the correct account context.

Before using this skill, read every file in the [references folder](references/), including the shared [references/_shared/](references/_shared/) docs.

## Suggested tools

### Pre-flight (CC-1, see shared doc)
- `getUserProfile` / `listAccount` — resolve accessible accounts
- `getEffectiveAccess` / `getEffectiveAccessWorkspaces` — validate per-resource access (hasActorAccessToResource is only for Views/Dashboards/Tags/Widgets)
- `getAccountDetails` — enrich account-ids for the picker

### Core intelligence
- `searchVulnerabilityData` — core CVE record (CVSS, EPSS, Securin Risk Index/SVRS, CISA KEV, published/modified dates, CWE, affected products, exploit counts)
- `searchThreatActorData` — threat actors exploiting this CVE. Actor records are flat (top-level `name`, `description`, `associatedGroups`, `vulnerabilities`, …) — do NOT pass `fields: ['threatActor']`; that prefix doesn't match the actual shape and the call returns empty rows silently. Omit `fields` to get the full record, or list specific top-level keys.
- `searchWeaknessData` — CWE context, root-cause classification
- `searchComponentData` — affected software components / package versions
- `getApiFields` with `entityType: ["VULNERABILITY"]` — field discovery
- `createDeepLink` / `getDeepLink` — platform URLs (see [_shared/deep-links.md](references/_shared/deep-links.md))
- **Web search** (built-in) — vendor advisory, PoC status, security news

## Workflow

### Step 1 — Normalize the subject

- CVE ID format: `CVE-YYYY-NNNNN`. Normalize case, strip whitespace.
- Vulnerability name (no CVE): use it as a text query to `searchVulnerabilityData` via the name/alias fields; ask the user to confirm the match.

### Step 2 — Parallel Core queries

Run these **in parallel** for latency:

| Query | Purpose |
|---|---|
| `searchVulnerabilityData` filter: `vulnerabilityId = 'CVE-XXXX'` | Primary vuln record — also surfaces `riskIndex.contributingFactors[]` and `riskIndex.changeLog[]` with threat/ransomware commentary |
| `searchThreatActorData` filter: bare-path FQL on the actor record (e.g., `vulnerabilities like 'CVE-XXXX-NNNNN'` or `associatedGroups like '<group>'` — confirm the exact field via `getApiFields(entityType=['THREATACTOR'])`). Do NOT pass `fields: ['threatActor']` — actor records are flat, so that prefix returns empty silently. | Actor attribution |
| `searchWeaknessData` filter: joined on CWE from vuln record | CWE context (run after step 2 primary completes, or parallel if CWE is known) |
| **Web search** | Ransomware / malware / campaign linkage via `riskIndex.contributingFactors[]` and web search |

Namespace note: **no `vulnerabilities.` prefix** inside `searchVulnerabilityData` — use bare field paths (`vulnerabilityId`, not `vulnerabilities.id`). See [_shared/fql-grammar.md](references/_shared/fql-grammar.md).

### Step 3 — Enrich affected products

From the vuln record's top-level `products[]` and `vendors[]` arrays (plus `affectedSoftwareConfigurations` for CPE-level detail and `affectedProductCount` for the rollup), call `getProducts` / `searchComponentData` to expand product names and versions into human-readable rows.

### Step 4 — Web search for vendor advisory + PoC

Search the web for:
- The vendor advisory URL (e.g., `site:paloaltonetworks.com CVE-2024-3400`).
- Public PoC status (GitHub, Exploit-DB).
- Security news / exploitation timeline.

**Read the content** of the advisory — do not just link it. Extract: fixed version, disclosure timeline, known workarounds.

### Step 5 — Generate deep links (CC-2)

Call `createDeepLink` for:
- The vulnerability detail view (platform's vulnerability page for this CVE).
- Filtered lists for any affected product / threat-actor / ransomware you mention.

See [_shared/deep-links.md](references/_shared/deep-links.md).

### Step 6 — Synthesize report

Use the 7-section structure below. Every section that names an entity carries a deep link.

## Response structure

```markdown
## CVE-XXXX-YYYY — <title>

**Verdict:** <Critical / High / Medium / Low — KEV: yes/no — actively exploited: yes/no>

### 1. Identity
- CVE ID, published, modified, CWE, vendor
- [View on Securin Platform](<createDeepLink URL>)

### 2. Severity & Scoring
- CVSS v3: base / vector
- EPSS: probability
- Securin Risk Index / SVRS: score + severity band
- (interpretation — see references/risk-scoring.md)

### 3. Exploit Landscape
- CISA KEV: yes/no + date added
- Exploited in the wild: yes/no (source)
- Public PoCs: count + notable repos
- Exploit maturity: from the CVSS temporal/threat metric in `vulnerabilities.cvssv3.vector` (`E:F`/`E:P`/`E:U` → Functional / Proof-of-Concept / Unproven) or `vulnerabilities.cvssv4.vector` (`E:A`/`E:P`/`E:U` → Attacked / Proof-of-Concept / Unreported)

### 4. Threat Actor Attribution
| Actor | Motivation | Recent activity | Link |
|---|---|---|---|
| … | … | … | [View](<deep link>) |

### 5. Ransomware / Campaign Links
| Family / Campaign | First seen | Notes | Link |
|---|---|---|---|
| … | … | … | [View](<deep link>) |

### 6. Affected Products
| Vendor | Product | Affected versions | Fixed in | Link |
|---|---|---|---|---|
| … | … | … | … | [View](<deep link>) |

### 7. References
- Vendor advisory (quote the remediation steps)
- NVD entry
- CISA KEV entry (if applicable)
- Notable news / blog posts

### Next steps
- "Check if you're affected" → use **securin-threat-correlation**
- "Plan remediation" → use **securin-remediation-guidance**
```

## Scope guard (CC-3)

If the user asks "am I affected" or "show me my exposures to this CVE", **stop** and hand off to `securin-threat-correlation`. This skill is strictly global intel.

If the user asks "how do I fix this", hand off to `securin-remediation-guidance`.

## Edge cases

- **CVE not found in Core:** some very new CVEs may not be indexed yet. Tell the user, fall back to web search, and offer to re-run later.
- **Reserved / rejected CVE:** `searchVulnerabilityData` may return a record with minimal fields. Report what's available and flag status.
- **Non-CVE vulnerability (vendor-specific ID):** accept the vendor ID, query by name, surface the record but note no CVE mapping.
- **Multiple matches on name search:** ask the user to pick which CVE.

## Visual output (CC-4)

When this skill produces aggregated or multi-row data (counts, trends, distributions, comparisons, single-CVE reports), emit a chart/graph/infographic in the Securin brand — multi-series palette (`#9C66FF / #7F30FF / #E96001 / #4D268D / #DD639C / …`, assigned in order), semantic CHML severity colors (Critical `#A60D08` → Info `#C5CBD6`), Poppins headings on DM Sans body, light theme, and the Securin logo. Use the 10-stop brand purple ramp for heatmaps/sequential scales; gradients are background decoration only — never on chart bars, lines, or slices. Full color system in [_shared/brand.md](references/_shared/brand.md). Offer customization after delivery; never default to a different brand.

## References

- [Risk Scoring Interpretation](references/risk-scoring.md) — how to read SVRS / EPSS / CISA KEV together.
- [Shared: Account Preflight](references/_shared/account-preflight.md)
- [Shared: Deep Links](references/_shared/deep-links.md)
- [Shared: FQL Grammar](references/_shared/fql-grammar.md)
- [Shared: Sorting Rules](references/_shared/sorting-rules.md)
- [Shared: Brand & Visual Communication](references/_shared/brand.md)