Exploit Availability Check
ContributedGiven a CVE or vuln name, reports an exploit-maturity tier and in-the-wild status from CISA KEV, EPSS, Metasploit, Nuclei, Exploit-DB, and GitHub PoC trackers.
What it does
Exploit Availability Check answers the single question that drives real-world patch triage: is this vulnerability weaponized right now? Given a CVE ID — or a named vulnerability such as Log4Shell, Zerologon, or BlueKeep — it returns an exploit-maturity tier (Weaponized → Public working exploit → Proof-of-concept only → No public exploit found) and, reported separately, whether the CVE is being exploited in the wild.
It is strictly a defensive prioritization aid. It locates and rates the maturity of already-public exploit material so defenders can decide what to patch first; it does not write exploit code, weaponize proofs-of-concept, or provide exploitation steps, and its guardrails explicitly refuse those requests.
The skill runs against public, open-source data with no API keys, caches the large feeds locally for sub-second repeat lookups, and can emit a client-ready Markdown + CSV report for an entire CVE list at once.
How it works
For each CVE the skill consults seven public sources and maps every result to structured data:
- CISA KEV — known exploited-in-the-wild status and ransomware-campaign flag.
- FIRST EPSS — 30-day exploitation-probability score and percentile.
- Metasploit (rapid7/metasploit-framework, BSD-3) — packaged module metadata, distinguishing exploit and
auxiliary/adminmodules from mere scanners and surfacing each module’s reliability rank. - Nuclei (projectdiscovery/nuclei-templates, MIT) — whether a detection/verification template ships.
- Exploit-DB — archived exploit entries and their verified flag.
- nomi-sec/PoC-in-GitHub and trickest/cve — star-ranked GitHub proof-of-concept repositories.
It then assigns a baseline maturity tier from those signals and refines it by reading repository substance (star counts and descriptions distinguish real exploits from patch scripts, scanners, and write-ups), always reporting in-the-wild status separately from public code maturity because the two frequently diverge — for example, a KEV-listed 0-day whose only public code is a crasher. Because the underlying feeds can lag real-world activity and absence of public code never proves a vulnerability is unexploitable, the skill states those limitations in its output.