Agent Skills
› Unclecheng-li/VulnClaw
› redteam-cve-validation
redteam-cve-validation
GitHub用于在红队模式下验证候选CVE的适用性。基于目标证据、版本指纹和范围数据，判断漏洞是否可用、已修复或无关。遵循安全边界，优先被动确认，若证据不足则返回侦察阶段，确保决策基于实证而非猜测。
Trigger Scenarios
cve_candidate_list_ready
Install
npx skills add Unclecheng-li/VulnClaw --skill redteam-cve-validation -g -y
SKILL.md
Frontmatter
{
"name": "redteam-cve-validation",
"description": "CVE validation domain card. Use after CVE lookup has produced applicable or candidate CVEs and red-team mode needs scoped evidence to decide whether to continue, pivot, or report."
}
CVE Validation
Domain
Validate candidate CVEs against the current target evidence without assuming exploitability.
The module consumes cve_candidate_list, product/version evidence, service fingerprints, and scope data, then decides whether the CVE path is usable, patched, not applicable, or needs more recon.
Trigger
cve_candidate_list_ready
Feedback Gates
- Scope Gate: target and asset must be in the declared authorization boundary.
- Evidence Gate: candidate CVE must map to observed product, version, endpoint, service, or fingerprint evidence.
- Applicability Gate: version range, configuration, and reachable component must plausibly match.
- Patch Gate: observed version or vendor advisory must not prove the issue fixed.
- Execution Gate: active validation requires a registered scoped adapter; missing adapters block rather than pretending execution happened.
Boundaries
- Do not run destructive or broad exploit attempts.
- Do not validate outside the declared target and scope.
- Do not treat CVE names alone as proof.
- Prefer passive or low-noise confirmation first.
- If evidence is insufficient, return to recon or CVE lookup rather than guessing.
Pivot Hints
- Candidate has no product/version match -> return to recon-intake for better fingerprinting.
- Candidate is patched or not applicable -> route by highest-ranked attack surface from recon.
- Tool or adapter missing -> record missing capability and request/choose an equivalent adapter.
- Too many candidates -> rank by reachable component, confidence, impact, and version fit.
Exit Conditions
- Confirmed applicable candidate -> continue to the specific validation/testing skill.
- All candidates patched/not applicable -> exit to evidence-based router.
- Evidence incomplete -> return to recon-intake or cve-lookup.
- Required tool/scope/adapter missing -> block with the missing capability or scope evidence.
Exit Evidence
- Required: cve_validation_result
- Optional: cve_patch_status, applicability_proof, non_applicability_reason
- min_attempts: 1
Capabilities
cve_applicability -> cve_validation_result
patch_status_check -> cve_patch_status
page_fetch -> applicability_proof
Version History
- 38379b0 Current 2026-07-22 12:03
