managing-vulnerabilities

Name: managing-vulnerabilities
Author: ancoleman

51installs59forks

How to install managing-vulnerabilities?

ancoleman/ai-design-components/managing-vulnerabilities

$npx -y skills add ancoleman/ai-design-components --skill managing-vulnerabilities

Installs into the current project.

Summary

Implementing multi-layer security scanning (container, SAST, DAST, SCA, secrets), SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines. Use when building DevSecOps workflows, ensuring compliance, or establishing security gates for container deployments.

Files · 1

View on GitHub

SKILL.md

1	# Vulnerability Management
2
3	Implement comprehensive vulnerability detection and remediation workflows across containers, source code, dependencies, and running applications. This skill covers multi-layer scanning strategies, SBOM generation (CycloneDX and SPDX), risk-based prioritization using CVSS/EPSS/KEV, and CI/CD security gate patterns.
4
5	## When to Use This Skill
6
7	Invoke this skill when:
8
9	- Building security scanning into CI/CD pipelines
10	- Generating Software Bills of Materials (SBOMs) for compliance
11	- Prioritizing vulnerability remediation using risk-based approaches
12	- Implementing security gates (fail builds on critical vulnerabilities)
13	- Scanning container images before deployment
14	- Detecting secrets, misconfigurations, or code vulnerabilities
15	- Establishing DevSecOps practices and automation
16	- Meeting regulatory requirements (SBOM mandates, Executive Order 14028)
17
18	## Multi-Layer Scanning Strategy
19
20	Vulnerability management requires scanning at multiple layers. Each layer detects different types of security issues.
21
22	### Layer Overview
23
24	Container Image Scanning
25	- Detects vulnerabilities in OS packages, language dependencies, and binaries
26	- Tools: Trivy (comprehensive), Grype (accuracy-focused), Snyk Container (commercial)
27	- When: Every container build, base image selection, registry admission control
28
29	SAST (Static Application Security Testing)
30	- Analyzes source code for security flaws before runtime
31	- Tools: Semgrep (fast, semantic), Snyk Code (developer-first), SonarQube (enterprise)
32	- When: Every commit, PR checks, main branch protection
33
34	DAST (Dynamic Application Security Testing)
35	- Tests running applications for vulnerabilities (black-box testing)
36	- Tools: OWASP ZAP (open-source), StackHawk (CI/CD native), Burp Suite (manual + automated)
37	- When: Staging environment testing, API validation, authentication testing
38
39	SCA (Software Composition Analysis)
40	- Analyzes third-party dependencies for known vulnerabilities
41	- Tools: Dependabot (GitHub native), Renovate (advanced), Snyk Open Source (commercial)
42	- When: Every build, dependency updates, license audits
43
44	Secret Scanning
45	- Prevents secrets from being committed to source code
46	- Tools: Gitleaks (fast, configurable), TruffleHog (entropy detection), GitGuardian (commercial)
47	- When: Pre-commit hooks, repository scanning, CI/CD artifact checks
48
49	### Quick Tool Selection
50
51	```
52	Container Image → Trivy (default choice) OR Grype (accuracy focus)
53	Source Code → Semgrep (open-source) OR Snyk Code (commercial)
54	Running Application → OWASP ZAP (open-source) OR StackHawk (CI/CD native)
55	Dependencies → Dependabot (GitHub) OR Renovate (advanced automation)
56	Secrets → Gitleaks (open-source) OR GitGuardian (commercial)
57	```
58
59	For detailed tool selection guidance, see `references/tool-selection.md`.
60
61	## SBOM Generation
62
63	Software Bills of Materials (SBOMs) provide a complete inventory of software components and dependencies. Required for compliance and security transparency.
64
65	### CycloneDX vs. SPDX
66
67	CycloneDX (Recommended for DevSecOps)
68	- Security-focused, OWASP-maintained
69	- Native vulnerability references
70	- Fast, lightweight (JSON/XML/ProtoBuf)
71	- Best for: DevSecOps pipelines, vulnerability tracking
72
73	SPDX (Recommended for Legal/Compliance)
74	- License compliance focus, ISO standard (ISO/IEC 5962:2021)
75	- Comprehensive legal metadata
76	- Government/defense preferred format
77	- Best for: Legal teams, compliance audits, federal requirements
78
79	### Generating SBOMs
80
81	With Trivy (CycloneDX or SPDX):
82	```bash
83	# CycloneDX format (recommended for security)
84	trivy image --format cyclonedx --output sbom.json myapp:latest
85
86	# SPDX format (for compliance)
87	trivy image --format spdx-json --output sbom-spdx.json myapp:latest
88
89	# Scan SBOM (faster than re-scanning image)
90	trivy sbom sbom.json --severity HIGH,CRITICAL
91	```
92
93	With Syft (high accuracy):
94	```bash
95	# Generate CycloneDX
96	syft myapp:latest -o cyclonedx-json=sbom.json
97
98	# Generate SPDX
99	syft myapp:latest -o spdx-json=sbom-spdx.json
100
101	# Pipe to Grype for scanning
102	syft myapp:latest -o json \| grype
103	```
104
105	For comprehensive SBOM patterns and storage strategies, see `references/sbom-guide.md`.
106
107	## Vulnerability Prioritization
108
109	Not all vulnerabilities require immediate action. Prioritize based on actual risk using CVSS, EPSS, and KEV.
110
111	### Modern Risk-Based Prioritization
112
113	Step 1: Gather Metrics
114
115	\| Metric \| Source \| Purpose \|
116	\|--------\|--------\|---------\|
117	\| CVSS Base Score \| NVD, vendor advisories \| Vulnerability severity (0-10) \|
118	\| EPSS Score \| FIRST.org API \| Exploitation probability (0-1) \|
119	\| KEV Status \| CISA KEV Catalog \| Actively exploited CVEs \|
120	\| Asset Criticality \| Internal CMDB \| Business

People who liked this also viewed

6 picks

Type

managing-vulnerabilities

51installs59forks

View on GitHub

How to install managing-vulnerabilities?

ancoleman/ai-design-components/managing-vulnerabilities

$npx -y skills add ancoleman/ai-design-components --skill managing-vulnerabilities

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Vulnerability Management
2
3	Implement comprehensive vulnerability detection and remediation workflows across containers, source code, dependencies, and running applications. This skill covers multi-layer scanning strategies, SBOM generation (CycloneDX and SPDX), risk-based prioritization using CVSS/EPSS/KEV, and CI/CD security gate patterns.
4
5	## When to Use This Skill
6
7	Invoke this skill when:
8
9	- Building security scanning into CI/CD pipelines
10	- Generating Software Bills of Materials (SBOMs) for compliance
11	- Prioritizing vulnerability remediation using risk-based approaches
12	- Implementing security gates (fail builds on critical vulnerabilities)
13	- Scanning container images before deployment
14	- Detecting secrets, misconfigurations, or code vulnerabilities
15	- Establishing DevSecOps practices and automation
16	- Meeting regulatory requirements (SBOM mandates, Executive Order 14028)
17
18	## Multi-Layer Scanning Strategy
19
20	Vulnerability management requires scanning at multiple layers. Each layer detects different types of security issues.
21
22	### Layer Overview
23
24	Container Image Scanning
25	- Detects vulnerabilities in OS packages, language dependencies, and binaries
26	- Tools: Trivy (comprehensive), Grype (accuracy-focused), Snyk Container (commercial)
27	- When: Every container build, base image selection, registry admission control
28
29	SAST (Static Application Security Testing)
30	- Analyzes source code for security flaws before runtime
31	- Tools: Semgrep (fast, semantic), Snyk Code (developer-first), SonarQube (enterprise)
32	- When: Every commit, PR checks, main branch protection
33
34	DAST (Dynamic Application Security Testing)
35	- Tests running applications for vulnerabilities (black-box testing)
36	- Tools: OWASP ZAP (open-source), StackHawk (CI/CD native), Burp Suite (manual + automated)
37	- When: Staging environment testing, API validation, authentication testing
38
39	SCA (Software Composition Analysis)
40	- Analyzes third-party dependencies for known vulnerabilities
41	- Tools: Dependabot (GitHub native), Renovate (advanced), Snyk Open Source (commercial)
42	- When: Every build, dependency updates, license audits
43
44	Secret Scanning
45	- Prevents secrets from being committed to source code
46	- Tools: Gitleaks (fast, configurable), TruffleHog (entropy detection), GitGuardian (commercial)
47	- When: Pre-commit hooks, repository scanning, CI/CD artifact checks
48
49	### Quick Tool Selection
50
51	```
52	Container Image → Trivy (default choice) OR Grype (accuracy focus)
53	Source Code → Semgrep (open-source) OR Snyk Code (commercial)
54	Running Application → OWASP ZAP (open-source) OR StackHawk (CI/CD native)
55	Dependencies → Dependabot (GitHub) OR Renovate (advanced automation)
56	Secrets → Gitleaks (open-source) OR GitGuardian (commercial)
57	```
58
59	For detailed tool selection guidance, see `references/tool-selection.md`.
60
61	## SBOM Generation
62
63	Software Bills of Materials (SBOMs) provide a complete inventory of software components and dependencies. Required for compliance and security transparency.
64
65	### CycloneDX vs. SPDX
66
67	CycloneDX (Recommended for DevSecOps)
68	- Security-focused, OWASP-maintained
69	- Native vulnerability references
70	- Fast, lightweight (JSON/XML/ProtoBuf)
71	- Best for: DevSecOps pipelines, vulnerability tracking
72
73	SPDX (Recommended for Legal/Compliance)
74	- License compliance focus, ISO standard (ISO/IEC 5962:2021)
75	- Comprehensive legal metadata
76	- Government/defense preferred format
77	- Best for: Legal teams, compliance audits, federal requirements
78
79	### Generating SBOMs
80
81	With Trivy (CycloneDX or SPDX):
82	```bash
83	# CycloneDX format (recommended for security)
84	trivy image --format cyclonedx --output sbom.json myapp:latest
85
86	# SPDX format (for compliance)
87	trivy image --format spdx-json --output sbom-spdx.json myapp:latest
88
89	# Scan SBOM (faster than re-scanning image)
90	trivy sbom sbom.json --severity HIGH,CRITICAL
91	```
92
93	With Syft (high accuracy):
94	```bash
95	# Generate CycloneDX
96	syft myapp:latest -o cyclonedx-json=sbom.json
97
98	# Generate SPDX
99	syft myapp:latest -o spdx-json=sbom-spdx.json
100
101	# Pipe to Grype for scanning
102	syft myapp:latest -o json \| grype
103	```
104
105	For comprehensive SBOM patterns and storage strategies, see `references/sbom-guide.md`.
106
107	## Vulnerability Prioritization
108
109	Not all vulnerabilities require immediate action. Prioritize based on actual risk using CVSS, EPSS, and KEV.
110
111	### Modern Risk-Based Prioritization
112
113	Step 1: Gather Metrics
114
115	\| Metric \| Source \| Purpose \|
116	\|--------\|--------\|---------\|
117	\| CVSS Base Score \| NVD, vendor advisories \| Vulnerability severity (0-10) \|
118	\| EPSS Score \| FIRST.org API \| Exploitation probability (0-1) \|
119	\| KEV Status \| CISA KEV Catalog \| Actively exploited CVEs \|
120	\| Asset Criticality \| Internal CMDB \| Business

People who liked this also viewed

6 picks

Type