Exploit Availability Check
Given a CVE or vuln name, reports an exploit-maturity tier and in-the-wild status from CISA KEV, EPSS, Metasploit, Nuclei, Exploit-DB, and GitHub PoC trackers.
Baseline review at submission: an accuracy and overt-behavior check, not a full security audit, and it does not cover later changes to the repository. Learn more about our security review process.
What it does
Exploit Availability Check answers the single question that drives real-world patch triage: is this vulnerability weaponized right now? Given a CVE ID — or a named vulnerability such as Log4Shell, Zerologon, or BlueKeep — it returns an exploit-maturity tier (Weaponized → Public working exploit → Proof-of-concept only → No public exploit found) and, reported separately, whether the CVE is being exploited in the wild.
It is strictly a defensive prioritization aid. It locates and rates the maturity of already-public exploit material so defenders can decide what to patch first; it does not write exploit code, weaponize proofs-of-concept, or provide exploitation steps, and its guardrails explicitly refuse those requests.
The skill runs against public, open-source data with no API keys, caches the large feeds locally for sub-second repeat lookups, and can emit a client-ready Markdown + CSV report for an entire CVE list at once.
How it works
For each CVE the skill consults seven public sources and maps every result to structured data:
- CISA KEV — known exploited-in-the-wild status and ransomware-campaign flag.
- FIRST EPSS — 30-day exploitation-probability score and percentile.
- Metasploit (rapid7/metasploit-framework, BSD-3) — packaged module metadata, distinguishing exploit and
auxiliary/adminmodules from mere scanners and surfacing each module’s reliability rank. - Nuclei (projectdiscovery/nuclei-templates, MIT) — whether a detection/verification template ships.
- Exploit-DB — archived exploit entries and their verified flag.
- nomi-sec/PoC-in-GitHub and trickest/cve — star-ranked GitHub proof-of-concept repositories.
It then assigns a baseline maturity tier from those signals and refines it by reading repository substance (star counts and descriptions distinguish real exploits from patch scripts, scanners, and write-ups), always reporting in-the-wild status separately from public code maturity because the two frequently diverge — for example, a KEV-listed 0-day whose only public code is a crasher. Because the underlying feeds can lag real-world activity and absence of public code never proves a vulnerability is unexploitable, the skill states those limitations in its output.