# Kev

> CISA KEV 已知被利用漏洞目录比对：组件 CVE 是否在 KEV 清单、优先级判定。触发词：KEV、已利用漏洞、在野利用。component-nday 匹配出 CVE 后必查。

- Skill: `wufufu770/kev` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wufufu770/kev`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/kev/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- License: MIT
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/kev

---


## TL;DR

- **目的**：Query CISA KEV and prioritize CVEs by real-world exploitation
- **适用**：时间受限的项目 + 大量 CVE 时的排序
- **输入**：CVE 列表或组件名
- **输出**：优先级排序（KEV + EPSS 分数）+ 报告建议
- **红线**：仅参考 KEV，不作为唯一决策依据
- **关联**：上游：component-nday → 下游：cve-poc-generator, fp-check


## When to Use

- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology

## When NOT to Use

- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
## Workflow

1. **Get CVEs** — From component fingerprint
2. **Check KEV** — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
3. **Get EPSS** — https://api.first.org/data/v1/epss
4. **Score** — KEV present = high priority; EPSS > 0.5 = high
5. **Prioritize** — KEV + high EPSS first
6. **Report** — Document exploitation likelihood


## Advanced Techniques

### CISA KEV API
Query `https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json` for latest additions (updated daily).

### EPSS Cross-Reference
After KEV check, use EPSS API (`https://api.first.org/data/v1/epss`) for exploitation probability. KEV + EPSS > 0.5 = highest priority.

### Threat Intel Integration
Combine KEV with your threat intel feeds (e.g., GreyNoise, Shodan Monitor) to know if active exploitation is observed in the wild right now.