# Exploit Availability Check

> Given a CVE or vuln name, reports an exploit-maturity tier and in-the-wild status from CISA KEV, EPSS, Metasploit, Nuclei, Exploit-DB, and GitHub PoC trackers.

- Type: Skill
- Author: kevinmhorvath
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-08-13
- Source repository: https://github.com/kevinmhorvath/exploit-availability-check
- Repo state: not archived
- Last push: 2026-08-18T22:00:59Z
- Stars: 14 (a popularity signal, not a safety signal)
- Forks: 1 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Rapid7
- Domains: vulnerability-management, threat-intelligence
- Tags: vulnerability-management, exploit-intelligence, cve, threat-prioritization, kev, epss, patch-prioritization
- Date added: 2026-08-07
- Compatible platforms: Claude Code, Claude Cowork
- Invocation: `Ask about a CVE or named vuln, e.g. 'is CVE-2021-44228 weaponized?' or 'any PoC for Log4Shell?'`
- Listing page: https://exchange.tenable.com/skills/exploit-availability-check
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/exploit-availability-check.md

## What it does

Exploit Availability Check answers the single question that drives real-world patch triage: **is this vulnerability weaponized right now?** Given a CVE ID — or a named vulnerability such as Log4Shell, Zerologon, or BlueKeep — it returns an **exploit-maturity tier** (Weaponized → Public working exploit → Proof-of-concept only → No public exploit found) and, reported separately, whether the CVE is **being exploited in the wild**.

It is strictly a defensive prioritization aid. It locates and rates the maturity of *already-public* exploit material so defenders can decide what to patch first; it does not write exploit code, weaponize proofs-of-concept, or provide exploitation steps, and its guardrails explicitly refuse those requests.

The skill runs against public, open-source data with no API keys, caches the large feeds locally for sub-second repeat lookups, and can emit a client-ready Markdown + CSV report for an entire CVE list at once.

## How it works

For each CVE the skill consults seven public sources and maps every result to structured data:

- **CISA KEV** — known exploited-in-the-wild status and ransomware-campaign flag.
- **FIRST EPSS** — 30-day exploitation-probability score and percentile.
- **Metasploit** (rapid7/metasploit-framework, BSD-3) — packaged module metadata, distinguishing exploit and `auxiliary/admin` modules from mere scanners and surfacing each module's reliability rank.
- **Nuclei** (projectdiscovery/nuclei-templates, MIT) — whether a detection/verification template ships.
- **Exploit-DB** — archived exploit entries and their verified flag.
- **nomi-sec/PoC-in-GitHub** and **trickest/cve** — star-ranked GitHub proof-of-concept repositories.

It then assigns a baseline maturity tier from those signals and refines it by reading repository substance (star counts and descriptions distinguish real exploits from patch scripts, scanners, and write-ups), always reporting in-the-wild status separately from public code maturity because the two frequently diverge — for example, a KEV-listed 0-day whose only public code is a crasher. Because the underlying feeds can lag real-world activity and absence of public code never proves a vulnerability is unexploitable, the skill states those limitations in its output.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/exploit-availability-check.json. The full index and how to read it: https://exchange.tenable.com/llms.txt