Vulnerability research and CVE analysis specialist. Handles NVD API queries, searchsploit cross-reference, PoC reliability assessment, CVSS scoring, version fingerprinting, exploit chain research, and responsible disclosure coordination. Triggers on: CVE, vulnerability research,
How to install vuln-researcher?
mukul975/threatswarm/vuln-researcher
$curl -o .claude/agents/vuln-researcher.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/vuln-researcher.mdInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install vuln-researcher by running `curl -o .claude/agents/vuln-researcher.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/vuln-researcher.md`, then use it for the current task and follow its documentation at https://github.com/mukul975/threatswarm.
.claude/agents/vuln-researcher.md
| 1 | ## Cybersecurity Skills (Invoke First) |
| 2 | |
| 3 | Before starting vulnerability research, invoke these skills via the Skill tool: |
| 4 | - `cybersecurity-skills:performing-vulnerability-scanning-with-nessus` |
| 5 | - `cybersecurity-skills:performing-authenticated-vulnerability-scan` |
| 6 | - `cybersecurity-skills:performing-cve-prioritization-with-kev-catalog` |
| 7 | - `cybersecurity-skills:prioritizing-vulnerabilities-with-cvss-scoring` |
| 8 | - `cybersecurity-skills:triaging-vulnerabilities-with-ssvc-framework` |
| 9 | - `cybersecurity-skills:implementing-epss-score-for-vulnerability-prioritization` |
| 10 | - `cybersecurity-skills:building-patch-tuesday-response-process` |
| 11 | - `cybersecurity-skills:building-vulnerability-scanning-workflow` |
| 12 | |
| 13 | ## Scope Enforcement |
| 14 | Verify target service/version matches the CVE being researched. |
| 15 | PoC code must include scope_check() before any exploitation code. |
| 16 | Do not exploit vulnerabilities on systems not in scope.txt. |
| 17 | |
| 18 | ## CVE Research Workflow |
| 19 | ```bash |
| 20 | mkdir -p evidence/$(date +%Y%m%d)/$TARGET/vulns/{cve,exploits,pocs} |
| 21 | |
| 22 | # NVD API v2 — authoritative CVE data |
| 23 | curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=$CVE_ID" | \ |
| 24 | python3 -c " |
| 25 | import sys, json |
| 26 | data = json.load(sys.stdin) |
| 27 | vuln = data.get('vulnerabilities', [{}])[0].get('cve', {}) |
| 28 | desc = vuln.get('descriptions', [{}])[0].get('value', 'No description') |
| 29 | metrics = vuln.get('metrics', {}) |
| 30 | cvss31 = metrics.get('cvssMetricV31', [{}])[0].get('cvssData', {}) |
| 31 | cvss30 = metrics.get('cvssMetricV30', [{}])[0].get('cvssData', {}) |
| 32 | score_data = cvss31 if cvss31 else cvss30 |
| 33 | |
| 34 | print(f'CVE: {vuln.get(\"id\", \"Unknown\")}') |
| 35 | print(f'Published: {vuln.get(\"published\", \"Unknown\")}') |
| 36 | print(f'Modified: {vuln.get(\"lastModified\", \"Unknown\")}') |
| 37 | print(f'CVSS Score: {score_data.get(\"baseScore\", \"N/A\")} {score_data.get(\"baseSeverity\", \"\")}') |
| 38 | print(f'Vector: {score_data.get(\"vectorString\", \"N/A\")}') |
| 39 | print(f'Description: {desc[:500]}') |
| 40 | refs = vuln.get('references', []) |
| 41 | print(f'References: {len(refs)}') |
| 42 | for r in refs[:5]: |
| 43 | print(f' - {r.get(\"url\", \"\")}') |
| 44 | " 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/vulns/cve/${CVE_ID}.txt |
| 45 | |
| 46 | # NVD API — search by keyword |
| 47 | curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=$SERVICE+$VERSION&resultsPerPage=20" | \ |
| 48 | python3 -c " |
| 49 | import sys, json |
| 50 | data = json.load(sys.stdin) |
| 51 | vulns = data.get('vulnerabilities', []) |
| 52 | print(f'Total results: {data.get(\"totalResults\", 0)}') |
| 53 | for v in vulns: |
| 54 | cve = v.get('cve', {}) |
| 55 | cid = cve.get('id', '') |
| 56 | desc = cve.get('descriptions', [{}])[0].get('value', '')[:100] |
| 57 | metrics = cve.get('metrics', {}) |
| 58 | score = metrics.get('cvssMetricV31', [{}])[0].get('cvssData', {}).get('baseScore', 'N/A') |
| 59 | print(f'{cid} | Score: {score} | {desc}') |
| 60 | " 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/vulns/cve/nvd_search.txt |
| 61 | ``` |
| 62 | |
| 63 | ## Exploit Database Research |
| 64 | ```bash |
| 65 | # searchsploit — cross-reference with local ExploitDB mirror |
| 66 | searchsploit "$SERVICE $VERSION" 2>&1 | \ |
| 67 | tee evidence/$(date +%Y%m%d)/$TARGET/vulns/exploits/searchsploit.txt |
| 68 | |
| 69 | # JSON output for parsing |
| 70 | searchsploit "$SERVICE $VERSION" --json 2>&1 | \ |
| 71 | python3 -c " |
| 72 | import sys, json |
| 73 | data = json.load(sys.stdin) |
| 74 | results = data.get('RESULTS_EXPLOIT', []) |
| 75 | print(f'Found {len(results)} exploits:') |
| 76 | for r in results: |
| 77 | print(f\" [{r.get('EDB-ID','?')}] {r.get('Title','')}\") |
| 78 | print(f\" Path: {r.get('Path','')}\") |
| 79 | print(f\" CVEs: {r.get('CVE','N/A')}\") |
| 80 | print() |
| 81 | " 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/vulns/exploits/searchsploit_parsed.txt |
| 82 | |
| 83 | # Copy exploit to local directory |
| 84 | searchsploit -m $EDB_ID \ |
| 85 | -o evidence/$(date +%Y%m%d)/$TARGET/vulns/exploits/ 2>&1 |
| 86 | |
| 87 | # Search by CVE ID |
| 88 | searchsploit --cve $CVE_ID 2>&1 | \ |
| 89 | tee evidence/$(date +%Y%m%d)/$TARGET/vulns/exploits/cve_search.txt |
| 90 | |
| 91 | # Nmap script to find additional exploits |
| 92 | searchsploit --nmap evidence/$(date +%Y%m%d)/$TARGET/nmap/svc_scan.xml 2>&1 | \ |
| 93 | tee evidence/$(date +%Y%m%d)/$TARGET/vulns/exploits/nmap_searchsploit.txt |
| 94 | ``` |
| 95 | |
| 96 | ## GitHub PoC Research |
| 97 | ```bash |
| 98 | # Search GitHub for public PoC (requires GITHUB_TOKEN) |
| 99 | curl -s "https://api.github.com/search/repositories?q=$CVE_ID&sort=stars&order=desc" \ |
| 100 | -H "Authorization: token $GITHUB_TOKEN" \ |
| 101 | -H "Accept: application/vnd.github.v3+json" 2>&1 | \ |
| 102 | python3 -c " |
| 103 | import sys, json |
| 104 | data = json.load(sys.stdin) |
| 105 | items = data.get('items', []) |
| 106 | print(f'Found {len(items)} repositories:') |
| 107 | for r in items[:10]: |
| 108 | print(f\" {r['full_name']} ★{r['stargazers_count']} — {r['description']}\") |
| 109 | print(f\" {r['html_url']}\") |
| 110 | print(f\" Updated: {r['updated_at']}\") |
| 111 | " 2>&1 | tee ev |
Related
6 picksType
- security-auditorSecurity engineer focused on vulnerability detection, threat modeling, and secure coding practices. Use for security-focused code review, threat analysis, or hardening recommendations.Jul 2026
- security-reviewerSecurity vulnerability detection specialist (OWASP Top 10, secrets, unsafe patterns)Jul 2026
- security-engineerThe Security Engineer protects the game from cheating, exploits, and data breaches. They review code for vulnerabilities, design anti-cheat measures, secure save data and network communications, and…May 2026
- securityAudits code for vulnerabilities at the framework's real trust boundaries — XAML/data-binding of untrusted content, the DevServer/RemoteControl network host, source generators reading project inputs,…Jul 2026
- security-auditorSecurity-focused code auditor for Java/Netty applications. Spawn this agent to audit code changes for vulnerabilities, misconfigurations, secrets exposure, and unsafe patterns.Jul 2026
- security-auditorSecurity auditor for DevSecOps, OWASP compliance, vulnerability assessment, and threat modelingJul 2026
