Search, analyze, and correlate CVEs against target technology stacks with exploit availability assessment
From greyhatccnpx claudepluginhub overtimepog/greyhatcc --plugin greyhatccThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
/greyhatcc:cve <CVE-ID or product name or keyword>
{{ARGUMENTS}} is parsed automatically:
No format specification needed — detect and proceed.
Before executing this skill:
.greyhatcc/scope.json — verify target is in scope, note exclusions.greyhatcc/hunt-state.json — check active phase, resume contextfindings_log.md, tested.json, gadgets.json — avoid duplicating worktech_stack.md — correlate CVEs with detected versionsgreyhatcc_sec__cve_detail for specific CVEgreyhatcc_sec__cve_search with product name + versiongreyhatcc_sec__cve_search with vulnerability typeFor each CVE found:
greyhatcc_sec__exploit_db_searchgreyhatcc_s__shodan_exploits_search"CVE-YYYY-NNNNN" exploit PoC"CVE-YYYY-NNNNN" nuclei template| CVSS Metric | Meaning for Testing |
|---|---|
| AV:N (Network) | Exploitable remotely — highest priority |
| AV:A (Adjacent) | Needs network proximity — lower priority for remote testing |
| AC:L (Low) | No special conditions — straightforward exploitation |
| AC:H (High) | Needs specific config/timing — may not apply to target |
| PR:N (None) | No auth needed — can test unauthenticated |
| PR:L (Low) | Needs basic account — need test credentials |
| UI:N (None) | No user interaction — server-side exploitable |
| UI:R (Required) | Needs victim action — client-side attack |
| Availability Level | What It Means | Action |
|---|---|---|
| Public exploit on Exploit-DB | Ready to use or adapt | Download, test against target |
| Metasploit module exists | Automated exploitation | Use if in scope |
| GitHub PoC exists | May need adaptation | Review code, adapt for target |
| Nuclei template exists | Automated detection | Run nuclei with specific template |
| No public exploit | Theoretical only | NOTE: most programs reject "vulnerable library without working PoC" |
| Patch diff available | Can reverse-engineer exploit | Write custom PoC from patch analysis |
Cross-reference detected versions from recon/tech_stack.md:
For each technology in tech_stack.md:
1. Extract exact version (e.g., "Apache 2.4.51")
2. Search CVEs for that product + version range
3. Check if detected version falls in affected range
4. If yes AND exploit available → HIGH priority testing target
5. If yes AND no exploit → add to gadgets as potential, low priority
Delegate to vuln-analyst for deep analysis or vuln-analyst-low for quick assessment.
## CVE-YYYY-NNNNN
**Severity**: CRITICAL (CVSS 9.8)
**Vector**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
**Description**: ...
**Affected**: Product X versions 1.0-2.3
**Target Version**: Product X 2.1 (detected in tech_stack.md)
**In Affected Range**: YES
**Exploits Available**: Yes - Exploit-DB #12345, Metasploit module, GitHub PoC
**Exploit Tested**: [YES/NO] — [result]
**Remediation**: Upgrade to version 2.4+
**Chain Potential**: [what this CVE provides if exploited: code_execution, file_read, etc.]
After completing this skill:
tested.json — record what was tested (asset + vuln class)gadgets.json — add any informational findings with provides/requires tags for chainingfindings_log.md — log any confirmed findings with severity