oasm-platform/open-asm/vulnerability-analysis

Vulnerability Analysis

Use this skill when the user asks for detailed vulnerability analysis beyond basic CVE lookup.

A CVE matched to a version is a hypothesis, not a finding. What the analysis must answer: is this component actually exposed, is the vulnerable code path reachable here, is there a working exploit, and what does an attacker get. Say which of those you proved and which you inferred.

When to Use

• User asks "how serious is this vulnerability?"
• User asks about exploit availability or PoC code
• User wants to understand impact on their specific infrastructure
• User asks about mitigation or remediation steps
• User wants to prioritize which vulnerabilities to fix first

Workflow

0. Goal and Todo (Agent mode)

Before any lookup, call formulate_plan(steps), then start step 1 with transition_step(id, "in_progress"); tool calls are refused until a step is in progress.

• Goal: generated from the request and pinned above the plan, e.g. "Decide how urgently CVE-2024-1234 must be fixed on our assets, with the affected hosts and the fix". Pass a goal to formulate_plan only to correct it.
• Steps: the sections below, trimmed to what the goal needs — gather workspace data, enrich from external sources, analyze, present findings (and track the issue when asked).

Keep the analysis on the pinned goal: CVEs or assets that come up but are not part of it go under next steps.

1. Gather Vulnerability Data

Start with built-in OASM tools to get workspace context:

2. Enrich with External Sources

For deeper analysis, use retrieve_web_page to fetch from these sources:

CVE Details:

• Trickest CVE: https://raw.githubusercontent.com/trickest/cve/refs/heads/main/{YEAR}/CVE-{YEAR}-{NUMBER}.md
• NVD API: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-{YEAR}-{NUMBER}

Exploit Intelligence:

• GitHub PoC search: https://github.com/nomi-sec/PoC-in-GitHub
• Exploit-DB: https://www.exploit-db.com/search
• Metasploit modules: https://www.rapid7.com/db/modules/
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• EPSS scores: https://api.first.org/data/v1/epss?cve=CVE-{YEAR}-{NUMBER}

Vendor Advisories:

• Microsoft MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-{YEAR}-{NUMBER}
• Apache security: https://lists.apache.org/thread/

3. Analyze the Vulnerability

For each vulnerability, evaluate these dimensions:

Severity Assessment

• CVSS v3.1 base score and vector string
• EPSS (Exploit Prediction Scoring System) if available
• CISA KEV (Known Exploited Vulnerabilities) catalog status
• Contextual severity: is the affected component internet-facing?

Exploit Maturity

Categorize the exploit status:

• None: No known exploits
• PoC: Proof-of-concept code exists (GitHub, write-ups)
• Functional: Exploit works reliably but not mass-deployed
• Weaponized: Used in real attacks, available in exploit frameworks

Affected Scope

• List affected products and versions from the CVE
• Cross-reference with workspace assets using enumerate_assets and fingerprint_technologies
• Determine exposure: internet-facing vs internal-only

Exposure, not just severity

• A CVSS 9.8 on an internal, patched, unreachable host is lower priority than a CVSS 7.5 on an internet-facing service with a public PoC. Rank by reachability × exploit maturity × data at stake, and say what the rank is based on.
• Confirm the version from evidence (banner, header, response, TLS cert) rather than from an inventory field alone, and note when you could not confirm it.

Remediation Guidance

• Patch availability and version
• Workarounds if no patch exists (WAF rules, network segmentation, disable feature)
• Priority level:
• Immediate: Exploited in the wild (check CISA KEV)
• High: Functional exploit or PoC available
• Medium: Vulnerable but no known exploit
• Low: Informational or low-impact

4. Present Findings

Structure your analysis as:

**Goal**: Met / Partly met / Not met — one line on why
 
**Summary**: One-line overview of the vulnerability
 
**Severity**: CVSS score + vector + EPSS (if available)
 
**Exploit Status**: None / PoC / Functional / Weaponized
 
**Affected Assets**: X assets in your workspace match
- asset1.example.com (nginx 1.18)
- asset2.example.com (Apache 2.4.49)
 
**Impact**: What an attacker can achieve (e.g., RCE, data leak, DoS)
 
**Remediation**: Specific steps with version numbers
- Upgrade to X.Y.Z or later
- Temporary: apply WAF rule / disable feature
 
**Priority**: Immediate / High / Medium / Low

5. Track the Issue

After analysis:

• If no existing issue, suggest creating one via the Issues system
• Store key findings in stm_write for reference during the conversation
• Use ltm_write to persist critical vulnerability intelligence for the workspace