This skill automates producing professional CVE request packages from pentest findings. For each qualifying finding it generates MITRE CVE form data, a GitHub Security Advisory draft, a full disclosure report, a vendor notification email template, and machine-readable candidate JSON. It also provides CWE mapping, CVSS guidance, and a reproducible workflow for responsible disclosure.
Invoke this skill after completing a penetration test when you have verified, true-positive findings that merit CVE requests. Use it to standardize disclosure artifacts before contacting vendors or submitting MITRE/GitHub advisories. The skill is user-invocable only and expects researcher contact info as input.
Best used by security-focused agents or human-guided workflows able to read findings files, compute CVSS, and write filesystem artifacts (Pentest agents, Claude Code capable agents).
This skill has not been reviewed by our automated audit pipeline yet.
