Agent skills in security engineering: encoding the vulnerability triage loop

Working through the security queue, I keep hitting the same friction. A CVE lands with a CVSS 9.8 and a recommended library bump. Looks clear. Except: is this service actually internet-facing, or is i