## https://sploitus.com/exploit?id=AF4A8DCC-04F8-5F1D-B562-0A9FFAFBAB44
# exploit-availability-check
A Claude skill (and standalone script) that answers one question fast and defensibly:
**if an attacker wanted to exploit this vulnerability today, how ready-made is the tooling?**
Give it a CVE ID or a named vulnerability (Log4Shell, EternalBlue, BlueKeep, Zerologon, …)
and it reports an **exploit-maturity tier** plus whether the CVE is **exploited in the wild** —
built for vulnerability triage, patch prioritization, and pentest scoping.
> Defensive / prioritization use only. It locates and rates the maturity of *already-public*
> exploit material. It does not write exploit code, weaponize PoCs, or provide exploitation steps.
## What it checks
| Source | Signal | License / data |
|---|---|---|
| CISA KEV | Exploited in the wild + ransomware use | US gov JSON feed |
| FIRST EPSS | Exploitation probability (30-day) | Public API |
| Metasploit | Packaged module (exploit vs auxiliary, reliability rank) | rapid7/metasploit-framework (BSD-3) |
| Nuclei | Detection/verification template exists | projectdiscovery/nuclei-templates (MIT) |
| Exploit-DB | Archived exploit entries (+ verified flag) | exploit-database CSV mirror |
| nomi-sec | GitHub PoC repos, star-ranked | nomi-sec/PoC-in-GitHub |
| trickest | GitHub PoC repos (broader) | trickest/cve |
Packet Storm, CXSecurity, and 0day.today are intentionally **not** queried (no open data feed;
0day.today is partly a paid marketplace).
## Maturity tiers
- 🔴 **Weaponized** — turnkey: a Metasploit exploit/admin module or a reliable high-star exploit repo
- 🟠 **Public working exploit** — functional code published (Exploit-DB and/or credible repo), may need tuning
- 🟡 **Proof-of-concept only** — the bug is demonstrated (crash / detection / partial), not reliable RCE
- ⚪ **No public exploit found** — advisories only (not "safe" — just no public code)
In-the-wild status (CISA KEV / EPSS) is reported **separately** from code maturity, because they diverge
(e.g. a KEV-listed 0-day whose only public code is a crasher).
## Usage (standalone script)
Requires Python 3 only (standard library).
```bash
# One or more CVEs
python3 scripts/exploit_check.py CVE-2021-44228 CVE-2020-1472
# Machine-readable
python3 scripts/exploit_check.py --json CVE-2024-3400
# Client-ready Markdown + CSV report
python3 scripts/exploit_check.py --report --out ./deliverables CVE-2021-44228 CVE-2014-0160
# Force-refresh the cached feeds (they cache 24h under ~/.cache/exploit-availability-check)
python3 scripts/exploit_check.py --refresh CVE-2023-4863
```
First run downloads ~35 MB of feeds once; subsequent runs are sub-second.
## Usage (as a Claude skill)
`SKILL.md` is a self-contained skill: drop it into your Claude skills directory (or install via the
Cowork "Save skill" flow). It embeds the same script and adds the triggering, judgment, and output
guidance. It triggers on prompts like *"is there an exploit for CVE-…"*, *"is this weaponized"*,
*"any PoC for …"*, or a bare CVE during triage.
## Caveats
- Feeds lag real-world activity (KEV/EPSS refresh daily; the GitHub indexes periodically). A brand-new
CVE may have exploits before any feed lists it.
- GitHub is noisy: many "CVE-XXXX" repos are patch scripts, scanners, or write-ups — some PoCs are malware.
Review any repo in a lab before trusting it.
- Absence of public exploit code is **not** proof a vulnerability is unexploitable.
## License
MIT — see [LICENSE](LICENSE). Bundled data sources retain their own licenses.