sunilgentyalasunilgentyala/OmniRed/skills/utility/cvss4-scoring/SKILL.md

cvss4-scoring

Skill5 starsChanged 5 months agoApache-2.0View on GitHub

CVSS v4.0 scoring guide for red team findings. Covers all metric groups (Base, Threat, Environmental, Supplemental), AI/LLM-specific scoring considerations, and OWASP LLM Top 10 to CVSS mapping.

In this repository33 other files it gives its agents.
- dcsyncSkill
- kerberoastingSkill
- pass-the-hashSkill
- jailbreakingSkill
- model-extractionSkill
- prompt-injectionSkill
- system-prompt-extractionSkill
- jwtSkill
- oauthSkill
- session-attacksSkill
- container-escapeSkill
- iam-privescSkill
- s3-enumSkill
- edr-evasionSkill
- initial-accessSkill
- embedding-attacksSkill
- rag-poisoningSkill
- mcp-context-injectionSkill
- mcp-rug-pullSkill
- mcp-tool-poisoningSkill
- osintSkill
- subdomain-enumSkill
- model-tamperingSkill
- report-writingSkill
- graphqlSkill
- idorSkill
- rceSkill
- sqliSkill
- ssrfSkill
- sstiSkill
- waf-bypassSkill
- xssSkill
- xxeSkill

The file

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Use the official FIRST calculator: https://www.first.org/cvss/calculator/4-0
line 114

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

CVSS v4.0 Scoring Guide

Base Metrics

Exploitability Metrics

Metric	Values	Notes
AV (Attack Vector)	N/A/L/P	Network=remotely exploitable; Physical=requires device
AC (Attack Complexity)	L/H	H=requires specific conditions or luck
AT (Attack Requirements)	N/P	P=target must be in non-default configuration
PR (Privileges Required)	N/L/H
UI (User Interaction)	N/P/A	N=no user needed; A=user must actively engage

Impact Metrics (Vulnerable System)

Metric	Values
VC (Confidentiality)	H/L/N
VI (Integrity)	H/L/N
VA (Availability)	H/L/N

Impact Metrics (Subsequent Systems)

Metric	Values	Notes
SC (Confidentiality)	H/L/N	Impact on other systems in scope
SI (Integrity)	H/L/N
SA (Availability)	H/L/N

Common Findings — Quick Scores

Finding	CVSS v4.0 Vector	Score
Unauthenticated RCE	AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	10.0
SQLi (auth bypass)	AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	9.3
Stored XSS (session hijack)	AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N	7.1
Reflected XSS	AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	5.3
SSRF (internal)	AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	8.6
IDOR (read)	AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	7.1

AI/LLM-Specific Scoring

Standard CVSS was designed for traditional software. Apply these adjustments for AI vulnerabilities:

Prompt Injection (Direct)

AV:N — Network (user input over API/web)
AC:L — No special conditions
AT:N — Default configurations are vulnerable
PR:N — Unauthenticated in most products
UI:N — No user interaction beyond sending the prompt
VC:H — System prompt, tool configs, session data
VI:H — Agent can be directed to take harmful actions
VA:N — Usually doesn't affect availability
SC:H — Multi-agent pipelines: subsequent systems affected

Indirect Prompt Injection (via RAG/web)

AV:N — Attacker controls external content
AC:H — Requires agent to retrieve attacker content
AT:P — Requires agent to have retrieval capability
PR:N — No credentials needed (content is public)
UI:N — Agent retrieves autonomously
SC:H — High: affects all users who trigger retrieval

MCP Tool Poisoning

AV:N — Network (unauthenticated tools/list)
AC:L — Low (no special conditions)
AT:N — None
PR:N — Unauthenticated endpoint
UI:N — Agent connects automatically
VC:H — Full context window visible to poisoned tool
VI:H — Agent can be directed to write files, call APIs
SC:H — Other MCP servers and downstream agents affected
Score: ~9.3

Threat Metrics (Optional)

E (Exploit Maturity)
  - U = Unreported
  - P = Proof-of-Concept
  - A = Attacked (in-the-wild exploitation confirmed)

Supplemental Metrics

S (Safety)         — N/P: physical harm possible
AU (Automatable)   — N/Y: can be automated at scale
R (Recovery)       — A/U/I: automatic/user/irrecoverable
V (Value Density)  — D/C: diffuse/concentrated
RE (Effort)        — L/M/H: low/medium/high response effort
U (Urgency)        — Clear/Green/Amber/Red

Calculator

Use the official FIRST calculator: https://www.first.org/cvss/calculator/4-0

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free