vulnerability-management

---

name: vulnerability-management description: Systematic vulnerability lifecycle management with SLAs: Critical 7d, High 30d, Medium 90d, Low 180d aligned with OWASP, NIST, CIS Controls license: Apache-2.0

Vulnerability Management Skill

Purpose

This skill provides systematic procedures for proactive vulnerability discovery, intelligent remediation, and transparent security communication across the CIA platform. It implements Hack23's bleeding-edge dependency management strategy with automated testing, security validation, and measurable outcomes aligned with business impact.

When to Use This Skill

Apply this skill when:

• ✅ Analyzing Dependabot pull requests for dependency updates
• ✅ Responding to GitHub Security Advisories or CodeQL alerts
• ✅ Triaging OWASP Dependency Check findings
• ✅ Prioritizing vulnerability remediation across repositories
• ✅ Managing SLA compliance for vulnerability fixes
• ✅ Conducting security audits or compliance assessments
• ✅ Implementing security patches for critical vulnerabilities
• ✅ Tracking end-of-life (EOL) dependencies and runtimes

Do NOT use for:

• ❌ General code quality issues (use code-quality-checks skill)
• ❌ Feature development (different concern)
• ❌ Performance optimization (use performance-engineer agent)

Decision Tree

%%{
  init: {
    'theme': 'base',
    'themeVariables': {
      'primaryColor': '#D32F2F',
      'primaryTextColor': '#fff',
      'lineColor': '#D32F2F',
      'secondaryColor': '#FF9800',
      'tertiaryColor': '#4CAF50'
    }
  }
}%%
flowchart TD
    START["🔍 Vulnerability Detected"] --> SOURCE{"📊 Detection Source?"}
    
    SOURCE -->|Dependabot| DEPEND["📦 Dependency Vulnerability"]
    SOURCE -->|CodeQL| CODE["💻 Code Vulnerability"]
    SOURCE -->|OWASP| OWASP["🔍 Dependency Check Finding"]
    SOURCE -->|Security Advisory| ADVISORY["🚨 GitHub Advisory"]
    
    DEPEND --> CVSS{"🎯 CVSS Score?"}
    CODE --> CVSS
    OWASP --> CVSS
    ADVISORY --> CVSS
    
    CVSS -->|9.0-10.0| CRITICAL["🔴 Critical<br/>SLA: 7 days"]
    CVSS -->|7.0-8.9| HIGH["🟠 High<br/>SLA: 30 days"]
    CVSS -->|4.0-6.9| MEDIUM["🟡 Medium<br/>SLA: 90 days"]
    CVSS -->|0.1-3.9| LOW["🟢 Low<br/>SLA: 180 days"]
    
    CRITICAL --> EXPLOIT{"🎯 Exploited in Wild?"}
    HIGH --> IMPACT{"💼 Business Impact?"}
    MEDIUM --> CONTEXT{"🔍 Contextual Risk?"}
    LOW --> SCHEDULE["📅 Schedule Remediation"]
    
    EXPLOIT -->|YES| IMMEDIATE["⚡ Immediate Action<br/>4 hours target"]
    EXPLOIT -->|NO| VERIFY["✅ Verify Exploitability"]
    
    IMPACT -->|Significant| PRIORITY["🔴 High Priority"]
    IMPACT -->|Limited| STANDARD["🟡 Standard Priority"]
    
    CONTEXT -->|Reachable| ASSESS["🔍 Risk Assessment"]
    CONTEXT -->|Unreachable| BACKLOG["📋 Backlog"]
    
    IMMEDIATE --> REMEDIATE["🔧 Apply Remediation"]
    VERIFY --> REMEDIATE
    PRIORITY --> REMEDIATE
    STANDARD --> REMEDIATE
    ASSESS --> REMEDIATE
    SCHEDULE --> REMEDIATE
    BACKLOG --> MONITOR["👁️ Monitor for Changes"]
    
    REMEDIATE --> TEST["🧪 Test & Validate"]
    TEST --> DOCUMENT["📝 Document Resolution"]
    DOCUMENT --> CLOSE["✅ Close Vulnerability"]
    
    style START fill:#2196F3,color:#fff
    style CRITICAL fill:#D32F2F,color:#fff
    style HIGH fill:#FF9800,color:#fff
    style MEDIUM fill:#FFC107,color:#000
    style LOW fill:#4CAF50,color:#fff
    style IMMEDIATE fill:#D32F2F,color:#fff
    style REMEDIATE fill:#1565C0,color:#fff
    style CLOSE fill:#4CAF50,color:#fff