performing-endpoint-vulnerability-remediation

Prioritizes CVEs by risk scoring and deploys patches, configuration fixes, and validation for endpoint remediation.

954|172|Updated Mar 13, 2026

Search Tags:#patch management #endpoint security #cvss #cve #vulnerability remediation #powerShell #epSS

Ready to run

npx skills add https://github.com/xalgord/xalgorix --skill performing-endpoint-vulnerability-remediation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: performing-endpoint-vulnerability-remediation
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/endpoint-security/performing-endpoint-vulnerability-remediation
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-endpoint-vulnerability-remediation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Vulnerability scans produce long lists of findings, but teams struggle to decide what to fix first, deploy patches reliably, and prove the fixes actually closed the vulnerabilities. This Skill turns raw scan results into a prioritized, validated remediation program.

Core Features & Use Cases

Risk-Based Prioritization: Combines CVSS, EPSS, CISA KEV membership, asset criticality, and network exposure into a P1-P4 priority matrix with SLA timelines (14/30/60/90 days).
Patch and Configuration Deployment: Provides WSUS, SCCM, Intune, and PowerShell workflows for deploying KB updates, plus registry/GPO/service remediations such as disabling SMBv1, Print Spooler, and LLMNR.
Zero-Day Handling and Validation: Covers workarounds and compensating controls when no patch exists, plus re-scan verification to confirm findings are closed.
Use Case: After a Nessus scan flags 200 endpoints with a CISA KEV-listed CVE, use this Skill to prioritize the finding as P1, deploy the KB via SCCM, verify installation with Get-HotFix, and confirm closure with a targeted re-scan.

Quick Start

Use this skill to build a prioritized remediation plan from my latest Nessus scan export and generate the PowerShell commands to deploy and verify the critical patches.

Frequently Asked Questions about performing-endpoint-vulnerability-remediation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prioritize vulnerabilities for patching?▼

Prioritize vulnerabilities by combining CVSS base score, EPSS exploitation probability, CISA KEV catalog membership, asset criticality, and network exposure. This skill maps those factors into a P1-P4 matrix with SLAs of 14, 30, 60, and 90 days.

How to deploy Windows security patches with PowerShell?▼

Install the PSWindowsUpdate module, then run Get-WindowsUpdate with the -KBArticleID parameter to install a specific KB. Verify installation afterward with Get-HotFix -Id or by checking systeminfo output for the KB number.

What should I do when no patch exists for a zero-day CVE?▼

Apply vendor-published workarounds such as disabling the vulnerable feature or service, deploy EDR detection rules, and add network-level blocking via WAF or firewall rules. Document the workaround with an expiration date and monitor vendor advisories and CISA KEV for the patch release.

Why does a patch show deployed but the vulnerability still appears in scans?▼

Deployment tools like WSUS or SCCM report a KB as sent, not installed, and many patches require a reboot to take effect. Confirm on the host with Get-HotFix, check the RebootPending registry key, and re-scan with the original tool to confirm closure.

Does this skill cover vulnerability scanning itself?▼

No, this skill covers remediation only and explicitly excludes scanning. It consumes scan exports from Nessus, Qualys, or Rapid7 as input, and application-layer vulnerabilities should be handled through DevSecOps processes instead.