https://github.com/zavora-ai/skill-security-vulnerability-management
Security vulnerability skill — CVE search, dependency audit, risk scoring, remediation plans
https://github.com/zavora-ai/skill-security-vulnerability-management
adk-rust agent-skills claude-skills cve enterprise mcp security vulnerabilities
Last synced: about 1 month ago
JSON representation
Security vulnerability skill — CVE search, dependency audit, risk scoring, remediation plans
- Host: GitHub
- URL: https://github.com/zavora-ai/skill-security-vulnerability-management
- Owner: zavora-ai
- License: other
- Created: 2026-05-25T04:55:18.000Z (about 2 months ago)
- Default Branch: main
- Last Pushed: 2026-05-25T05:08:11.000Z (about 2 months ago)
- Last Synced: 2026-05-25T07:11:09.898Z (about 2 months ago)
- Topics: adk-rust, agent-skills, claude-skills, cve, enterprise, mcp, security, vulnerabilities
- Size: 2.93 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Security Vulnerability Management Skill
> Vulnerability operations for AI agents — search advisories (CVE/GHSA/OSV/RustSec), audit dependencies, score risk by exploitability, generate remediation plans, and export compliance evidence via mcp-security-advisory.
[](https://agentskills.io)
[](https://github.com/zavora-ai/mcp-security-advisory)
[](https://enterprise.adk-rust.com)
[](LICENSE)
## What This Skill Does
| Workflow | Tool Calls | What It Achieves |
|----------|-----------|------------------|
| Dependency Audit | 3 | Scan → score → remediation plan |
| CVE Investigation | 2 | Advisory details + reachability |
| Patch Planning | 2 | Upgrade paths with breaking changes |
| Evidence Export | 1 | Compliance documentation |
### Without this skill:
- Vulnerabilities discovered weeks late
- No prioritization (all CVEs treated equally)
- Patches applied without checking breaking changes
- No compliance evidence for audits
### With this skill:
- Critical/exploitable CVEs flagged immediately (P0)
- Prioritized by exploitability × severity × exposure
- Breaking changes checked before patching
- Evidence exported for every remediation
## Installation
```bash
git clone https://github.com/zavora-ai/skill-security-vulnerability-management.git \
~/.skills/skills/security-vulnerability-management
```
## Requirements
**Required:** `mcp-security-advisory` (6 tools)
**Cross-MCP:**
- `mcp-github` — create issues + PRs for CVE fixes
- `mcp-slack` — critical vulnerability alerts
- `mcp-package-registry` — check fix compatibility
## Folder Structure
```
security-vulnerability-management/
├── SKILL.md # Decision tree + triage rules
├── scripts/
│ └── prioritize_cves.py # Risk scoring (exploitability × severity × exposure)
├── references/
│ ├── tool-sequences.md # 6 tools
│ ├── cross-mcp-workflows.md # Security + GitHub + Slack + Packages
│ └── examples.md # Audit, investigate, remediate
├── README.md
└── LICENSE
```
## Scripts
### `prioritize_cves.py`
```bash
python scripts/prioritize_cves.py '[{"severity": "critical", "exploitable": true, "fix_available": true}]'
# → [{"priority_score": 24.0, "action": "patch_now"}]
```
## Success Criteria
| Metric | Target |
|--------|--------|
| Critical response | Flagged immediately as P0 |
| Prioritization | Scored by exploitability, not just CVSS |
| Evidence | Exported for every remediation action |
## Contributors
| [
James Karanja Maina](https://github.com/jkmaina) |
|:---:|
## License
Apache-2.0 — Part of [ADK-Rust Enterprise](https://enterprise.adk-rust.com). Built with ❤️ by [Zavora AI](https://zavora.ai)