alan951/cvss31

CVSS v3.1 Skill

This skill enables precise CVSS v3.1 scoring — calculating Base, Temporal, and Environmental scores, generating vector strings, interpreting existing vectors, and producing professional vulnerability severity reports.

When to Use This Skill

• User asks to "score a vulnerability" or "calculate CVSS"
• User provides a CVE or vulnerability description and wants scoring guidance
• User provides a CVSS vector string for interpretation or recalculation
• User asks what a CVSS score means or how to score a specific metric
• User wants to generate a pentest or vulnerability report with CVSS data

---

Workflow

Step 1: Understand the Request Type

A) Calculate from scratch → Ask for metric values (see Metric Reference below), then compute and output score + vector string.

B) Parse an existing vector → Extract values, recompute scores, explain each metric.

C) Guide scoring of a vulnerability description → Analyze the described vuln and recommend metric values with justification.

D) Generate a report → Produce a professional markdown/docx section with the CVSS breakdown.

Step 2: Gather Metrics (if calculating from scratch)

Required (Base Metrics): Ask for all 8 base metrics. If the user describes a vulnerability without specifying metrics, infer appropriate values and explain your reasoning.

Optional (Temporal & Environmental): Only collect if user asks or if context clearly warrants it.

Step 3: Calculate Scores

Use the formulas in references/equations.md. For quick calculations, use the JavaScript calculator snippet in scripts/calculator.js.

Step 4: Output

Always provide:

1. Score (e.g., 9.8 Critical)
2. Severity Rating (None/Low/Medium/High/Critical)
3. Vector String (e.g., CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
4. Metric breakdown explaining each value and why
5. Recommendations (optional but valuable)

---

Quick Reference: Metric Values

BASE METRICS (all required)

Attack Vector (AV)

| Value | Code | Score | Meaning | |-------|------|-------|---------| | Network | N | 0.85 | Remotely exploitable over internet | | Adjacent | A | 0.62 | Requires same network/VLAN | | Local | L | 0.55 | Requires local access or social engineering | | Physical | P | 0.20 | Requires physical device access |

Attack Complexity (AC)

| Value | Code | Score | Meaning | |-------|------|-------|---------| | Low | L | 0.77 | Repeatable, no special conditions | | High | H | 0.44 | Requires specific race conditions or extra steps |

Privileges Required (PR)

| Value | Code | Score (Unchanged) | Score (Changed) | |-------|------|-------------------|-----------------| | None | N | 0.85 | 0.85 | | Low | L | 0.62 | 0.68 | | High | H | 0.27 | 0.50 |

User Interaction (UI)

| Value | Code | Score | |-------|------|-------| | None | N | 0.85 | | Required | R | 0.62 |

Scope (S)

| Value | Code | Meaning | |-------|------|---------| | Unchanged | U | Impact limited to vulnerable component | | Changed | C | Impact can reach beyond vulnerable component |

Confidentiality / Integrity / Availability (C/I/A)

| Value | Code | Score | |-------|------|-------| | High | H | 0.56 | | Low | L | 0.22 | | None | N | 0.00 |

TEMPORAL METRICS (optional)

Exploit Code Maturity (E)

| Value | Code | Multiplier | |-------|------|------------| | Not Defined | X | 1.00 | | High | H | 1.00 | | Functional | F | 0.97 | | Proof-of-Concept | P | 0.94 | | Unproven | U | 0.91 |

Remediation Level (RL)

| Value | Code | Multiplier | |-------|------|------------| | Not Defined | X | 1.00 | | Unavailable | U | 1.00 | | Workaround | W | 0.97 | | Temporary Fix | T | 0.96 | | Official Fix | O | 0.95 |

Report Confidence (RC)

| Value | Code | Multiplier | |-------|------|------------| | Not Defined | X | 1.00 | | Confirmed | C | 1.00 | | Reasonable | R | 0.96 | | Unknown | U | 0.92 |

ENVIRONMENTAL METRICS (optional)

Security Requirements (CR/IR/AR)

| Value | Code | Multiplier | |-------|------|------------| | Not Defined | X | 1.00 | | High | H | 1.50 | | Medium | M | 1.00 | | Low | L | 0.50 |

Modified Base Metrics (MAV/MAC/MPR/MUI/MS/MC/MI/MA)

Same values as Base metrics, plus Not Defined (X) which defaults to the Base metric value.

---

Severity Rating Scale

| Rating | Score Range | |--------|-------------| | None | 0.0 | | Low | 0.1 – 3.9 | | Medium | 4.0 – 6.9 | | High | 7.0 – 8.9 | | Critical | 9.0 – 10.0 |

---

Formulas (Summary)

Read references/equations.md for full equations. Key formulas:

ISS = 1 - [(1-C) × (1-I) × (1-A)]

Impact =
  If Scope Unchanged: 6.42 × ISS
  If Scope Changed:   7.52 × (ISS - 0.029) - 3.25 × (ISS - 0.02)^15

Exploitability = 8.22 × AV × AC × PR × UI

BaseScore =
  If Impact <= 0: 0
  If Scope Unchanged: Roundup(min(Impact + Exploitability, 10))
  If Scope Changed:   Roundup(min(1.08 × (Impact + Exploitability), 10))

TemporalScore = Roundup(BaseScore × E × RL × RC)

For Environmental, see references/equations.md.

Roundup function: returns smallest value to 1 decimal place ≥ input.

---

Output Template

When presenting a CVSS score, use this structure:

## CVSS v3.1 Score: [SCORE] ([SEVERITY])

**Vector String:** `CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X`

### Base Score: [X.X] ([SEVERITY])

| Metric | Value | Justification |
|--------|-------|---------------|
| Attack Vector | Network (N) | ... |
| Attack Complexity | Low (L) | ... |
| Privileges Required | None (N) | ... |
| User Interaction | None (N) | ... |
| Scope | Unchanged (U) | ... |
| Confidentiality | High (H) | ... |
| Integrity | High (H) | ... |
| Availability | High (H) | ... |

### Temporal Score: [X.X] (if applicable)
### Environmental Score: [X.X] (if applicable)

### Interpretation
[Brief paragraph explaining what this score means for prioritization]

---

Common Vulnerability Patterns

RCE over network, no auth: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H → Base: 9.8 Critical

SQL Injection (auth required): AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H → Base: 8.8 High

XSS (reflected, user interaction): AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N → Base: 6.1 Medium

Local privilege escalation: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H → Base: 7.8 High

Physical attack, info disclosure: AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N → Base: 4.6 Medium

---

Reference Files

• references/equations.md — Full mathematical equations with all edge cases
• references/scoring-guide.md — Detailed metric selection guidance with examples
• scripts/calculator.js — JavaScript implementation for accurate calculation

Read these when you need precision on edge cases or to verify calculations.