Prioritize vulnerability remediation using KEV-style exploitation context plus asset criticality. Use for CVE triage, patch order decisions, and remediation...

This skill looks coherent and runs locally on a provided JSON payload; it does not request keys or make network calls. Before use: (1) review the script yourself (it's short and readable) and run it in a controlled environment, (2) ensure input JSON is from a trusted source (it may contain sensitive asset data), (3) choose safe output paths to avoid overwriting important files, and (4) confirm the scoring thresholds and criticality mappings match your organization's policy. The code has some basic input assumptions (e.g., CVSS parsed as a float); malformed fields may raise errors, so validate inputs first.

Type: OpenClaw Skill Name: cyber-kev-triage Version: 0.1.0 The `scripts/kev_triage.py` file exhibits potential Local File Inclusion (LFI) and Local File Write (LFW) vulnerabilities. It directly uses user-supplied paths for `--input` and `--output` arguments without explicit sanitization or restriction, allowing the script to read arbitrary files (which it then attempts to parse as JSON) and write processed data to arbitrary locations on the filesystem. While the script's core functionality is benign and there's no evidence of intentional data exfiltration, command execution, or persistence, these vulnerabilities could be exploited by an attacker who can control the arguments passed to the script (e.g., via prompt injection against the OpenClaw agent) to access or modify files beyond the intended scope.