Trail of Bits' cvss-scoring skill turns a bug description into a CVSS v4.0 vector

Trail of Bits added a cvss-scoring skill to its marketplace on November 6th. Describe a vulnerability in plain text, and it returns a CVSS version 4.0 vector, a reason for every metric, and a calculator link with the score. A report's severity becomes something a reader can check.

Each of the eleven base metrics gets a value and one line tying it to a fact you wrote. An impact value your description doesn't settle is marked assumed, so you know which lines to check.

The skill doesn't compute the score. It puts the vector on a FIRST.org calculator link, and opening it selects every metric and shows the score. Version 4.0 scores come from a lookup table, so a number worked out by hand is a guess.

It lists the facts first. If attack vector, complexity, requirements, privileges or user interaction can't be settled from your description, it stops and asks you. Those five drive most of the score.

It rejects a common habit from version 3.1: marking attack complexity high because there are prerequisites. A race condition or a specific configuration now goes in attack requirements. High complexity is kept for getting past defenses like ASLR.

Before it answers, it compares its vector with the closest of 27 real, scored vulnerabilities, from Log4Shell and Heartbleed to regreSSHion. Where it differs much, it explains why or changes the metric.

A code-quality issue or a design concern gets a refusal, with no metrics made up to fill the table. A write-up in version 3.1 terms, like Scope, is flagged, and the mapping is listed.

In review, Evan Downing, who first wrote the skill, asked for four corrections. An API key the attacker can sign up for now counts as no privileges required. A deliberate action, like importing a file a certain way, counts as active interaction.

It's plugin version 1.2.0 for Claude Code and Codex. Its one eval is a single run on a SQL injection, so its accuracy is untested. I'd use it for the reasons table and still check the vector. Install steps are in the plugin's readme.