skills.rest
blamejs
blamejsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

coordinated-vuln-disclosure

Audit coordinated vulnerability disclosure programs for regulatory compliance and AI vulnerability handling.

Updated May 11, 2026
Search Tags:#nis2#bug-bounty#coordinated-vulnerability-disclosure#eu-cra#ai-vulnerability#csaf#security-txt
One-click install
npx skills add https://github.com/blamejs/exceptd-skills --skill coordinated-vuln-disclosure
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: coordinated-vuln-disclosure
Source: https://github.com/blamejs/exceptd-skills/tree/main/skills/coordinated-vuln-disclosure
Command: npx skills add https://github.com/blamejs/exceptd-skills --skill coordinated-vuln-disclosure

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Legacy security and compliance frameworks are built for pre-AI, on-prem environments and fail to address mid-2026 coordinated vulnerability disclosure (CVD) requirements, including AI-specific vulnerability classes, regulator-mandated 24-hour reporting clocks (EU CRA, NIS2), and broken upstream disclosure pipelines that feed zero-day learning loops. Organizations without a wired CVD pipeline risk non-compliance, missed regulatory deadlines, and unaddressed AI vulnerabilities that fall outside traditional CVE-shaped advisory models.

Core Features & Use Cases

  • Regulatory-aligned CVD program design: Operationalizes ISO 29147/30111, EU CRA Art. 11, NIS2 Art. 12, NYDFS 500.17, and other global CVD mandates, with explicit handling for AI vulnerabilities (prompt injection, model-weight tampering, training-data poisoning) that do not fit traditional versioned-software disclosure models.
  • End-to-end program assessment: Provides step-by-step audits of public intake surfaces (security.txt, VDP), policy conformance, internal handling lifecycles, bug bounty operations, regulator notification wiring, and advisory publication (CSAF 2.0, VEX, CVE Records).
  • Use Case: A EU-based AI vendor can use this skill to audit its CVD program for 24-hour ENISA notification compliance, map prompt-injection vulnerabilities to MITRE ATLAS TTPs for advisories, and align its bug bounty program to reward class-level AI findings that standard programs often ignore.

Quick Start

Use the coordinated-vuln-disclosure skill to audit your organization's vulnerability disclosure program for EU CRA 24-hour notification compliance and AI vulnerability handling gaps.

Frequently Asked Questions about coordinated-vuln-disclosure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a coordinated vulnerability disclosure program for EU CRA and NIS2 compliance?▼

Coordinated vulnerability disclosure programs for EU CRA and NIS2 compliance require operationalizing ISO 29147/30111 standards, mapping 24-hour ENISA notification timelines, and wiring regulator reporting pipelines to satisfy mandatory disclosure clocks.

What is the best way to handle AI vulnerabilities like prompt injection in a CVD pipeline?▼

Handling AI vulnerabilities in a CVD pipeline requires mapping non-traditional threats like prompt injection and model-weight tampering to MITRE ATLAS TTPs, enabling class-level advisory publication that standard versioned-software disclosure models ignore.

How do I generate CSAF 2.0 security advisories and deploy security.txt for vulnerability intake?▼

Generating CSAF 2.0 advisories and deploying security.txt involves auditing public intake surfaces, aligning VDP policies with internal handling lifecycles, and publishing VEX documents alongside CVE Records for end-to-end disclosure.

Does this coordinated vulnerability disclosure approach support NYDFS 500.17 regulator notification wiring?▼

Yes, this coordinated vulnerability disclosure approach explicitly supports NYDFS 500.17 regulator notification wiring alongside EU CRA Article 11 and NIS2 Article 12, ensuring global compliance mandates are operationally satisfied within your CVD program.

How do I audit a bug bounty program to ensure it rewards AI-specific vulnerability findings?▼

Auditing a bug bounty program for AI vulnerabilities involves assessing policy conformance and aligning reward structures to recognize class-level AI findings mapped to MITRE ATLAS, closing gaps where traditional programs miss non-versioned software threats.

When do I need to use coordinated vulnerability disclosure instead of standard CVE reporting?▼

You need coordinated vulnerability disclosure when traditional CVE-shaped advisory models fail to capture mid-2026 requirements, including AI-specific vulnerability classes, 24-hour regulator reporting clocks, and broken upstream zero-day disclosure pipelines.

Related Skills

Explore More Legal & Compliance Skills→
baobao0303baobao0303
1

harness-product-brief

Create, update, or validate product briefs with YAML frontmatter compliance.

Community
Advanced
nexus-substratenexus-substrate
18

security-advisory-response

Coordinate GitHub Security Advisory response workflows with private-fork patching and zero-disclosure publication.

Official
Advanced
SensLiaoSensLiao

security-response-red-purple-team

Map project attack surfaces to MITRE ATT&CK and ATLAS techniques.

Community
Advanced
Hack23Hack23
8

isms-compliance-checking

Validate code changes against Hack23 ISMS policies and security frameworks.

Official
Basic