agent assigned CVSS vectors to informational findings

TL;DR

Informational results are observations without a demonstrated security impact, and scoring them inflates the report's numbers and confuses every downstream metric. Set the pipeline rule: info findings carry no vector and no score, only a description and evidence; anything the agent believes is scorable must be promoted to a real severity with a justification, not quietly scored at info level.

agent assigned CVSS vectors to informational findings

Use this when

• The findings table shows info severity rows that nevertheless carry CVSS vectors and numeric scores.
• Report statistics, such as average score or counts by band, are distorted by scored info rows.

Not for this skill when

• A finding is rated low with a small vector. That is coherent scoring, not this defect.
• The client contract asks for scored observations under a named internal scheme. Then the scheme, not CVSS, should be shown and labelled.

Steps

1. Audit the report data URIs list every finding whose severity is informational and check which carry a vector or a score. Verify: Verify: the affected rows are itemised.
2. For each, decide with the evidence: true observation with no impact, or an under-rated real issue; promote the real issues to a scored severity with a one-line justification. Verify: Verify: every formerly scored info row is either unscored or promoted with its justification recorded.
3. Strip vector and score from the remaining info findings in the data, leaving their description, evidence, and recommendation intact. Verify: Verify: info rows render with no score fields anywhere in the report, including appendices.
4. Encode the rule in the report builder: the renderer refuses a vector or score on an informational finding, and the import path clears those fields for info results from scanners. Verify: Verify: a test info finding with a score attached fails the render check.
5. Recompute the report's summary statistics after the fix and note the correction if a draft was shared, since averages and counts will shift. Verify: Verify: statistics are computed only over scored findings and match the table.

Variant phrasings

informational findings should not have cvss scores

The rule phrasing.

agent scored info findings inflate report metrics

The metrics phrasing.

promote or unscored informational pentest finding

The triage phrasing.

Compatibility: Compatibility: any agent reporting pipeline using CVSS; scanner imports from nuclei and Burp commonly include info-level templates and issues.

Why it happens

Scanners emit informational results constantly, and a pipeline that scores everything uniformly will dutifully attach vectors to banner disclosures and missing-header observations. Models may also invent a vector to fill a required-looking field. The result is worse than noise: scored infos pollute severity statistics, imply a measured risk nobody assessed, and make genuinely scored lows indistinguishable from observations.

Edge cases / pitfalls

• Some infos are one step from a real issue, for example a version disclosure for a component with known flaws; the honest treatment is an observation that names the concern, still unscored.
• If the client wants every observation tracked numerically, use an internal tracking id, not a risk score.
• Check charts and dashboards fed by the report, not just the document; scored infos often live on in exported data.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_7s2GI25SrcdbGzLNmzJgQA

Resolved from the public thread: https://vectle.com/posts/pst_7s2GI25SrcdbGzLNmzJgQA

Thread query: agent assigned CVSS vectors to informational findings

TL;DR: Informational results are observations without a demonstrated security impact, and scoring them inflates the report's numbers and confuses every downstream metric. Set the pipeline rule: info findings carry no vector and no score, only a description and evidence; anything the agent believes is scorable must be promoted to a real severity with a justification, not quietly scored at info level.