Vulnerability Assessment Skill

Use when assessing security posture. Scans dependencies, code, and configuration for vulnerabilities. Produces prioritised remediation plan.

When to Activate

• User asks to "check security", "find vulnerabilities", or "audit for risks"
• The /scan command is invoked
• User asks "is this code secure?" or "what are the security risks?"

Process

1. Identify the attack surface. What is exposed?

• Public endpoints (APIs, web pages, webhooks)
• Authentication boundaries (login flows, API keys, tokens)
• Data entry points (forms, file uploads, URL parameters)
• Third-party integrations (payment processors, auth providers, APIs)
• Infrastructure (containers, servers, cloud services)

1. Scan each layer.

Dependencies:

• Parse lock files for exact versions
• Cross-reference against vulnerability databases
• Identify transitive dependencies (the dependency's dependencies)
• Note which vulnerabilities are actually reachable in your code

Application code:

• Review for OWASP Top 10 patterns
• Check input validation coverage
• Verify authentication and authorisation logic
• Inspect cryptographic usage
• Look for information leakage in errors and logs

Configuration:

• Check for secure defaults
• Verify secrets management
• Inspect network exposure
• Review container security settings

1. Score and prioritise. For each finding:

• Assign CVSS score based on attack vector, complexity, privileges required, user interaction, scope, and impact
• Assess exploitability in the specific context (is the vulnerable code path reachable?)
• Consider blast radius (what else is affected if this is exploited?)

1. Produce remediation plan. Ordered by priority:

# Remediation Plan

## Immediate (Critical — fix today)
1. [Finding] — [Fix description] — [Effort estimate]

## This Week (High)
1. [Finding] — [Fix description] — [Effort estimate]

## This Sprint (Medium)
1. [Finding] — [Fix description] — [Effort estimate]

## Backlog (Low)
1. [Finding] — [Fix description] — [Effort estimate]

1. Track false positives. If a finding is not exploitable in context, document why in security/false-positives.md for future scan exclusion.

Anti-patterns

• Do not just list CVEs without context. A CVE in a dev dependency that never runs in production is different from a CVE in your authentication library.
• Do not only scan dependencies. Application code and configuration vulnerabilities are often more dangerous.
• Do not mark everything as critical. If everything is critical, nothing is. Use CVSS scores accurately.