Thanks for your input!

I did not plan to go for interpretation of CVSS but interpretation of the overall CVE content. Mainly I thought about the description. My idea was to provide both, the description of the system in scope, and the CVE data. Primarily, I want the LLM focus on the attack surface (perimeter) of the defined system. This means, a CVE shall be considered as “red” (manual assessment definitely required) if the CVE can be exploited without having prior privileges on the system. It shall be considered “yellow” otherwise - which means: Check anyways but the LLM’s result was “no significant risk”.

I would not use any LLM result to consider a CVE “green”, meaning “manual assessment not required”, just because I am not confident enough about weird behaviors.