vulnerability-management

name	vulnerability-management
description	Vulnerability scanning, assessment, prioritization, and remediation processes following NIST and CIS Controls
license	Apache-2.0

Vulnerability Management Skill

🔴 AI FIRST Quality Principle

Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.

Purpose

Defines vulnerability management processes for identifying, assessing, prioritizing, and remediating security vulnerabilities.

Vulnerability Sources

• Dependabot — Dependency vulnerability alerts
• CodeQL — Static analysis security findings
• Secret Scanning — Exposed credentials detection
• npm audit — Node.js dependency vulnerabilities
• Manual Review — Code review and penetration testing

Severity Classification (CVSS)

Score	Rating	SLA
9.0-10.0	Critical	24 hours
7.0-8.9	High	7 days
4.0-6.9	Medium	30 days
0.1-3.9	Low	90 days

Remediation Process

1. Identify — Automated scanning and alerting
2. Assess — Determine severity and impact