菜单
Scan systems and dependencies for CVEs and security vulnerabilities. Use tools like Nessus, OpenVAS, and Qualys to identify and prioritize vulnerabilities. Use when performing security assessments, compliance scanning, or vulnerability management.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill vulnerability-scanning命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | vulnerability-scanning |
| description | Scan systems and dependencies for CVEs and security vulnerabilities. Use tools like Nessus, OpenVAS, and Qualys to identify and prioritize vulnerabilities. Use when performing security assessments, compliance scanning, or vulnerability management. |
| license | MIT |
| metadata | {"author":"devops-skills","version":"1.0"} |
Identify and prioritize security vulnerabilities across infrastructure and applications.
Use this skill when:
| Tool | Type | Best For |
|---|---|---|
| Nessus | Commercial | Enterprise scanning |
| OpenVAS | Open Source | Free alternative |
| Qualys | Cloud SaaS | Large scale |
| Nexpose/InsightVM |
| Commercial |
| Asset management |
| Nuclei | Open Source | Template-based |
# Run OpenVAS container
docker run -d --name openvas \
-p 443:443 \
-v openvas-data:/data \
greenbone/openvas-scanner
# Access web UI at https://localhost
# Default credentials: admin/admin
# Create target
omp -u admin -w admin --xml='<create_target>
<name>Web Servers</name>
<hosts>192.168.1.0/24</hosts>
</create_target>'
# Create task
omp -u admin -w admin --xml='<create_task>
<name>Weekly Scan</name>
<target id="target-uuid"/>
<config id="daba56c8-73ec-11df-a475-002264764cea"/>
</create_task>'
# Start task
omp -u admin -w admin --xml='<start_task task_id="task-uuid"/>'
# Get results
omp -u admin -w admin --xml='<get_results task_id="task-uuid"/>'
import requests
class NessusScanner:
def __init__(self, url, access_key, secret_key):
self.url = url
self.headers = {
'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}',
'Content-Type': 'application/json'
}
def create_scan(self, name, targets, template='basic'):
"""Create a new scan."""
templates = self.get('/editor/scan/templates')
template_uuid = next(
t['uuid'] for t in templates['templates']
if t['name'] == template
)
payload = {
'uuid': template_uuid,
'settings': {
'name': name,
'text_targets': targets,
'enabled': True
}
}
return self.post('/scans', payload)
def launch_scan(self, scan_id):
"""Start a scan."""
return self.post(f'/scans/{scan_id}/launch')
def get_results(self, scan_id):
"""Get scan results."""
return self.get(f'/scans/{scan_id}')
def export_report(self, scan_id, format='pdf'):
"""Export scan report."""
payload = {'format': format}
response = self.post(f'/scans/{scan_id}/export', payload)
file_id = response['file']
# Wait for export
while True:
status = self.get(f'/scans/{scan_id}/export/{file_id}/status')
if status['status'] == 'ready':
break
time.sleep(5)
return self.get(f'/scans/{scan_id}/export/{file_id}/download')
def get(self, path):
response = requests.get(f'{self.url}{path}', headers=self.headers, verify=False)
return response.json()
def post(self, path, data=None):
response = requests.post(f'{self.url}{path}', json=data, headers=self.headers, verify=False)
return response.json()
# Usage
scanner = NessusScanner('https://nessus:8834', 'access-key', 'secret-key')
scan = scanner.create_scan('Weekly Infrastructure Scan', '10.0.0.0/24')
scanner.launch_scan(scan['scan']['id'])
# Install nuclei
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
# Or download binary
wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip
unzip nuclei_linux_amd64.zip
# Update templates
nuclei -update-templates
# Scan single target
nuclei -u https://example.com
# Scan multiple targets
nuclei -l targets.txt
# Scan with specific templates
nuclei -u https://example.com -t cves/
nuclei -u https://example.com -t vulnerabilities/
# Scan with severity filter
nuclei -u https://example.com -s critical,high
# Output formats
nuclei -u https://example.com -o results.txt
nuclei -u https://example.com -json -o results.json
# custom-check.yaml
id: custom-admin-panel
info:
name: Admin Panel Detection
author: security-team
severity: info
tags: recon,panel
requests:
- method: GET
path:
- "{{BaseURL}}/admin"
- "{{BaseURL}}/administrator"
- "{{BaseURL}}/wp-admin"
matchers-condition: or
matchers:
- type: word
words:
- "admin"
- "login"
condition: and
- type: status
status:
- 200
- 301
- 302
| Score | Rating | Response Time |
|---|---|---|
| 9.0-10.0 | Critical | 24 hours |
| 7.0-8.9 | High | 7 days |
| 4.0-6.9 | Medium | 30 days |
| 0.1-3.9 | Low | 90 days |
prioritization_criteria:
critical_factors:
- Internet-facing systems
- Systems with sensitive data
- Active exploitation in the wild
- Authentication bypass
high_factors:
- Remote code execution
- Privilege escalation
- Data exfiltration risk
context_adjustments:
- Compensating controls in place (-1)
- No direct exposure (-1)
- Critical business system (+1)
- Compliance requirement (+1)
vulnerability_workflow:
discovery:
- Run scheduled scans
- Import third-party findings
- Correlate with asset inventory
analysis:
- Validate findings
- Remove false positives
- Assess business impact
- Prioritize by risk score
remediation:
- Assign to owners
- Track SLA compliance
- Verify fixes
- Document exceptions
reporting:
- Executive summaries
- Technical details
- Trend analysis
- Compliance metrics
## Vulnerability Ticket
**ID:** VULN-2024-001
**CVE:** CVE-2024-12345
**CVSS:** 9.8 (Critical)
**Affected System:** web-server-01
### Description
Remote code execution vulnerability in Apache Struts.
### Impact
Attacker can execute arbitrary code on the server.
### Remediation
1. Update Apache Struts to version 2.5.33
2. Apply WAF rule as temporary mitigation
### Timeline
- Discovered: 2024-01-15
- SLA Due: 2024-01-16
- Remediated: 2024-01-15
### Evidence
- Scan report: [link]
- Screenshot: [link]
name: Vulnerability Scan
on:
schedule:
- cron: '0 2 * * *'
push:
branches: [main]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Nuclei
uses: projectdiscovery/nuclei-action@main
with:
target: https://example.com
templates: cves/
output: nuclei-results.txt
- name: Check for critical findings
run: |
if grep -q "critical" nuclei-results.txt; then
echo "Critical vulnerabilities found!"
exit 1
fi
- name: Upload results
uses: actions/upload-artifact@v4
with:
name: vulnerability-report
path: nuclei-results.txt
# Using OpenSCAP
oscap xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis \
--results results.xml \
--report report.html \
/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
pci_scan_requirements:
quarterly:
- External vulnerability scan (ASV)
- Internal vulnerability scan
after_changes:
- Significant infrastructure changes
- New system deployments
passing_criteria:
- No vulnerabilities rated 4.0+ (CVSS)
- False positives documented
- Scan completed within 90 days
Problem: Scanner reports non-existent vulnerabilities Solution: Validate manually, tune scanner, maintain exception list
Problem: Not all assets scanned Solution: Update asset inventory, verify credentials, check network access
Problem: Scans affecting production systems Solution: Schedule during maintenance windows, use authenticated scans