Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →transilienceai/risk-prioritiser
Risk-based prioritisation of confirmed attack paths. Combines exploit feasibility, technical CVSS severity, and asset business impact into a single ranked list driving remediation roadmaps.
Passed 13 of 18 test cases with the skill, and 5 of 18 without it.
and 10 more in the full report
10 fixed7 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
A confirmed path has a score of 0.15. Which bucket in `artifacts/attack-paths-ranked.json` does this path belong to under default thresholds?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns paths scoring between 0.1 and 0.3 to the medium_term bucket. | Missed | Passed |
The instructions your model reads when the skill loads.
Consume the attack-path graph + the client-supplied business-tier map and emit a single ranked list of paths the org should remediate first. Mounted onto cloud-agent task #7.
Cron daily after attack-path-stitcher (task #6) completes. Also event-fires when a new validated/*.json is written with nvd.score >= 9.0.
artifacts/attack-paths.json — graph from task #6. Split into confirmed_paths (RFP-grade) and inferred_paths (topology/supply-chain).business-tier-map.csv — client-supplied asset → tier. Search order: {OUTPUT_DIR}/business-tier-map.csv → projects/rfp-3.3/schemas/business-tier-map.csv.confirmed_paths entry.
feasibility = product of every edge's feasibility along the path. For confirmed paths this is always 1.0.technical_severity = max_cvss_along_path / 10.business_impact = tier weight of the destination (crown_jewel = 1.0 by definition).entry_exposure = 1.0 if entry node is external: true, else 0.5.feasibility × technical_severity × business_impact × entry_exposure.feasibility = 1.0, business_impact = asset's own tier weight, hop count = 1.inferred_paths entry, but cap their bucket placement at theoretical regardless of numeric score. Inferred paths NEVER reach immediate / short_term / medium_term — RFP §3.3 requires "confirmed", and inferred paths are evidence-deficient by construction.immediate (0-7 days): confirmed AND score ≥ 0.6short_term (7-30 days): confirmed AND 0.3 ≤ score < 0.6medium_term (30-90 days): confirmed AND 0.1 ≤ score < 0.3monitor: confirmed AND score < 0.1theoretical (track-only): any path with path_class != "confirmed". Surfaced in board reports but excluded from the remediation SLA roadmap.artifacts/attack-paths-ranked.json + attack-paths-ranked.md. Each row carries path_class so downstream consumers can filter.| Tier | Weight |
|---|---|
crown_jewel | 1.00 |
revenue | 0.70 |
support | 0.40 |
dev | 0.20 |
unknown | 0.30 |
test cases passed, vs 5 / 18 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.