📚 Concepts & Theory
Synopsis
The Concepts section explains the why behind the CVSS Skills toolkit — the scoring math, the severity thresholds, the v3.0↔v3.1 quirks, and the validation/comparison models that every command and SDK call rests on.
If the CLI Reference and Go SDK docs tell you what to call, this section tells you what the numbers mean and where they come from. Every formula, threshold, and constant below is taken directly from the Go source — nothing is invented.
Learning Path
Read top to bottom for a complete mental model, or jump to the topic you need:
| Step | Topic | What you learn |
|---|---|---|
| 1 | Severity Ratings | The None/Low/Medium/High/Critical bands, their thresholds, and how a score maps to a label. |
| 2 | Scoring Formulas | Base = roundup(min(ISC+ESC, 10)), plus Temporal and Environmental extensions. |
| 3 | v3.0 vs v3.1 | The two version-specific quirks: UI:R scores and the roundUp algorithm. |
| 4 | Validation Model | Check (short-circuit) vs Validate (collect-all), and the sentinel errors. |
| 5 | Distance Metrics | Euclidean, Manhattan, Hamming, Jaccard, ScoreDifference — and their env/checked variants. |
| 6 | Presets & Severity | The ready-made CriticalV31/HighV31/... vectors and WithCriticalBase options. |
Where the Code Lives
All concepts map to concrete source files:
pkg/cvss/severity.go—Severitytype,GetSeverity,ParseSeveritypkg/cvss/calculator.go—calculateBaseScore,roundUp,calculateTemporalScore,calculateEnvironmentalScorepkg/cvss/scores.go—GetBaseScore,GetAllScores,RoundUppkg/cvss/validate.go/pkg/cvss/errors.go—Validate,ValidationErrors, sentinelspkg/cvss/distance.go/distance_env.go/distance_checked.go— five metrics + variantspkg/cvss/presets.go/options.go/pkg/mock/presets.go— preset vectors and optionspkg/vector/user_interaction.go— theUI:R0.56/0.62 version branch
Related
- Go SDK Overview — the package-level API that implements these concepts
- CLI Reference — command-line surface over the same core
- CVSS Metrics — per-metric value reference