菜单
Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/xalgord/xalgorix --skill building-vulnerability-exception-tracking-system命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
正在显示 SKILL.md
基于 SOC 职业分类
| name | building-vulnerability-exception-tracking-system |
| description | Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management. |
| domain | cybersecurity |
| subdomain | vulnerability-management |
| tags | ["vulnerability-exception","risk-acceptance","compensating-controls","exception-tracking","vulnerability-management","governance"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"] |
A vulnerability exception tracking system manages cases where vulnerabilities cannot be remediated within SLA timelines. It provides structured workflows for requesting exceptions, documenting compensating controls, obtaining risk acceptance approvals, and automatically expiring exceptions when their validity period ends. This ensures organizations maintain visibility into accepted risks while complying with frameworks like PCI DSS, SOC 2, and NIST CSF.
flask, sqlalchemy, requests, jinja2| Category | Description | Max Duration | Approver Level |
|---|---|---|---|
| Remediation Delay | Patch available but deployment blocked | 30 days | Team Lead + Security |
| No Fix Available | Vendor has not released a patch | 90 days |
| Security Director |
| Business Critical | System cannot be patched without outage | 60 days | VP Engineering + CISO |
| False Positive | Finding is not a real vulnerability | Permanent | Security Analyst |
| Compensating Control | Alternative mitigation in place | 180 days | Security Architect |
exception_schema = {
"cve_id": "CVE-2024-XXXX",
"finding_id": "unique-finding-reference",
"asset_hostname": "prod-db-01.corp.local",
"severity": "high",
"cvss_score": 8.1,
"category": "remediation_delay",
"justification": "Database upgrade required before patch can be applied",
"compensating_controls": [
"WAF rule blocking exploit pattern deployed",
"Network segmentation restricting access to trusted VLANs only",
"Enhanced monitoring via Splunk alert for exploitation indicators"
],
"requested_expiration": "2024-06-15",
"requestor_email": "dbadmin@company.com",
"approver_emails": ["security-lead@company.com", "ciso@company.com"],
"risk_rating": "medium",
}
CREATE TABLE vulnerability_exceptions (
id SERIAL PRIMARY KEY,
cve_id VARCHAR(20) NOT NULL,
finding_id VARCHAR(100) NOT NULL,
asset_hostname VARCHAR(255),
severity VARCHAR(20),
cvss_score DECIMAL(3,1),
category VARCHAR(50) NOT NULL,
justification TEXT NOT NULL,
compensating_controls TEXT,
status VARCHAR(20) DEFAULT 'pending',
requested_by VARCHAR(255) NOT NULL,
approved_by VARCHAR(255),
requested_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
approved_at TIMESTAMP,
expires_at TIMESTAMP NOT NULL,
expired BOOLEAN DEFAULT FALSE,
risk_rating VARCHAR(20),
review_notes TEXT,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
CREATE TABLE exception_audit_log (
id SERIAL PRIMARY KEY,
exception_id INTEGER REFERENCES vulnerability_exceptions(id),
action VARCHAR(50) NOT NULL,
actor VARCHAR(255) NOT NULL,
details TEXT,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
CREATE INDEX idx_exception_status ON vulnerability_exceptions(status);
CREATE INDEX idx_exception_expires ON vulnerability_exceptions(expires_at);
CREATE INDEX idx_exception_cve ON vulnerability_exceptions(cve_id);
from flask import Flask, request, jsonify
from datetime import datetime, timezone
import json
app = Flask(__name__)
@app.route("/api/exceptions", methods=["POST"])
def create_exception():
data = request.json
required = ["cve_id", "finding_id", "category", "justification", "expires_at", "requestor_email"]
for field in required:
if field not in data:
return jsonify({"error": f"Missing required field: {field}"}), 400
# Validate expiration does not exceed category maximum
max_days = {"remediation_delay": 30, "no_fix": 90, "business_critical": 60,
"false_positive": 365, "compensating_control": 180}
# Insert into database and notify approvers
return jsonify({"status": "pending", "id": "exc-12345"})
@app.route("/api/exceptions/<exc_id>/approve", methods=["POST"])
def approve_exception(exc_id):
approver = request.json.get("approver_email")
notes = request.json.get("notes", "")
# Update status to approved, record approver and timestamp
return jsonify({"status": "approved"})
@app.route("/api/exceptions/<exc_id>/reject", methods=["POST"])
def reject_exception(exc_id):
reviewer = request.json.get("reviewer_email")
reason = request.json.get("reason")
# Update status to rejected, record reviewer and reason
return jsonify({"status": "rejected"})
# Check for expired exceptions daily
python3 scripts/process.py --check-expirations
# Generate monthly exception report
python3 scripts/process.py --report --output exception_report.json
For each exception, compensating controls must address: