Investigate a CVE

Use this skill when the user asks "what do you know about CVE-XXXX-YYYYY?", "is there a public exploit for ...", or otherwise wants a complete picture of a single vulnerability.

Inputs

• cve_id (required) — a CVE or EIP identifier (e.g. CVE-2024-3400,

EIP-2024-00001). Accepts lowercase and Unicode-dash variants; the server normalises them.

Workflow

1. Get the intelligence brief. Call get_vulnerability with the

cve_id. This returns severity, CVSS v3/v4 and EPSS scores, KEV / ransomware flags, affected vendors and products, the description, and a ranked list of exploits.

1. Triage every exploit for safety. For each exploit ID in the

ranked list, call get_exploit_analysis. Record the AI classification (working_poc, scanner, tool, writeup, stub, no_code, suspicious, or trojan), the attack type, complexity, reliability, and MITRE ATT&CK techniques. Flag any `trojan` or `suspicious` classifications prominently — these are deceptive PoCs that drop malware on the operator. Do not review their code.

1. Read the best non-trojan PoC. Pick the highest-ranked exploit

that is not flagged as trojan/suspicious and call get_exploit_code. Summarise what the code does in plain language: the entry point, the payload, the prerequisites (auth? network position? specific version?), and any IOCs.

1. Find scanner coverage. Call get_nuclei_templates for the

same cve_id to discover Nuclei templates for active scanning plus any Shodan / FOFA / Google dorks for asset discovery.

Output

Return a structured Markdown report with these sections:

• Executive summary — severity, real-world exploitability, and

the bottom-line risk in one paragraph.

• Technical details — attack vector, prerequisites, affected

versions.

• Exploit landscape — every exploit ranked, with trojan

warnings called out first.

• Detection & scanning — Nuclei templates, recon dorks, IOCs.
• Remediation guidance — patches, mitigations, workarounds.

Safety notes

• Never present trojan or suspicious exploit code to the user

without an unmissable warning above the snippet.

• If get_vulnerability returns 404, tell the user the ID was

not found and offer to search instead.