Menu

Individual skill

vulnerability-management

0upvotes

Run a full vulnerability management lifecycle — discovery, prioritization, remediation SLAs, and continuous measurement.

skills/vulnerability-management/SKILL.md

Read pinned source

Source commit faf37c0859ebf627bfcb5225e8057d088691e0ae

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 8, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
56
Repository last updated
Oct 10, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

## Overview

Vulnerability management is the ongoing discipline of finding weaknesses across your estate, deciding which matter, getting them fixed on time, and proving it. It is not "run a scanner monthly" — it is a lifecycle: **discover → assess → prioritize → remediate → verify → report**. Done well, it is the highest-ROI security program most organizations run.

This skill covers building that lifecycle: asset coverage, risk-based prioritization, SLA design, exception handling, and metrics that show progress instead of scanner noise.

Vulnerability management is where security theory meets organizational reality: it succeeds or fails on asset ownership, engineering relationships, and the credibility of prioritization. The program's currency is trust — every false-priority escalation and every unactionable finding spends it. Spend it where the risk actually is.

## When to use

- Standing up or maturing a vuln-management program from ad-hoc scanning.
- Drowning in scanner findings and needing risk-based prioritization.
- Setting remediation SLAs and holding teams accountable without burning trust.
- Preparing for audits that ask for evidence of timely remediation.
Back to top