Skip to content

Fix CVSS score and privilege guidance #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
killerlux wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix CVSS score and privilege guidance #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions skills/triage/references/ai-slop.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,10 +70,12 @@ on YesWeHack.
flag any Environmental/Temporal metrics the hunter set themselves
(those are the program's to weigh; setting them inflates the score).
The classic LLM pattern is the "max-severity" vector
(`AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` = 9.8) defaulted onto a bug
(`AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` = 10.0) defaulted onto a bug
it doesn't fit. Common mismatches: `PR:N` claimed when auth has a
real gate (paid tier, admin invite, org membership) — `PR:N` is
only correct when self-registration is open; `UI:N` claimed when
real gate (paid tier, admin invite, org membership, or a basic user
account). Open self-registration does not make authenticated access
`PR:N`; use `PR:L` if the exploit depends on the account's privileges.
Another common mismatch is `UI:N` claimed when
the victim must click / paste / load; `S:C` claimed without an
actual trust boundary crossing; `AC:L` claimed when the resource ID
is a non-guessable UUID (that's `AC:H`). Check each metric against
Expand Down
5 changes: 3 additions & 2 deletions skills/write/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,8 +182,9 @@ are slop-prone, so verify them in your review:
- Sections present but empty / "TBD" / "see PoC".
- Steps that say "trigger the vulnerability" — not atomic.
- Impact section longer than the PoC.
- Severity vector that doesn't match the preconditions (e.g., `PR:L`
claimed when self-registration is open and `PR:N` applies).
- Severity vector that doesn't match the preconditions (e.g., `PR:N`
claimed even though the exploit requires an authenticated basic user.
Open self-registration does not remove that privilege requirement.)
- Repro steps that reference a screenshot instead of giving the URL.

Watch your own output for AI-slop patterns (theoretical impact,
Expand Down