security-assessment

What problem does it solve? Security triage on reported vulnerabilities often produces guessed CVSS scores that are off by a full severity band, leading to wrong CVE decisions. This Skill enforces a disciplined PSIRT workflow: decide if a finding is valid and exploitable, whether it needs a CVE and public bulletin, and compute the CVSS 4.0 score from a reviewed vector instead of guessing. ## Core Features & Use Cases - Computed CVSS 4.0 Scoring: Runs util/cvss4.py, a tested wrapper over the cvss pip package matching the FIRST 4.0 calculator, so the number is arithmetic on a reviewed vector, never a guess. - GAIA Vector Rubric: Guides metric selection (AV, AC, AT, PR, UI, VC/VI/VA, subsequent scope) with rules specific to agent-tool findings, including the confirmation-gate test that determines whether a bypass is a real CVE or defense-in-depth hardening. - Root-Cause CWE and PSIRT Template: Names the root-cause CWE before the consequence and fills the PSIRT/JIRA triage in order: validity, CVE decision, CVSS vector and score, CVE description, and mitigation deliverables. - Use Case: A researcher reports a command-allowlist bypass in a GAIA agent tool. Use this Skill to check whether the tool sits behind TOOLS_REQUIRING_CONFIRMATION, build the corrected CVSS 4.0 vector, compute the score with util/cvss4.py, and produce the triage verdict that moves the JIRA ticket from Opened to Assessed. ## Quick Start Triage this reported vulnerability in GAIA, decide whether it needs a CVE, and compute its CVSS 4.0 score with util/cvss4.py.