ssvc-SKILL.md

Apply the CISA SSVC framework to prioritize vulnerability remediation actions.

Updated Apr 20, 2026

Search Tags:#cvss #security-ops #kev #epss #ssvc #vulnerability triage

Ready to run

npx skills add https://github.com/DCx7C5/ai-marketplace --skill ssvc-skill-md

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssvc-SKILL.md
Source: https://github.com/DCx7C5/ai-marketplace/tree/main/skills/vulnerabilities/prioritization/ssvc
Command: npx skills add https://github.com/DCx7C5/ai-marketplace --skill ssvc-skill-md

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Prioritize vulnerability remediation by applying the CISA SSVC decision framework to scanner results and threat intelligence, aligning actions with risk-based triage.

Core Features & Use Cases

Ingest vulnerability data from scanners (Nessus/OpenVAS/CSV) and enrich with KEV, EPSS, and NVD data.
Apply the SSVC decision tree to produce actionable outcomes: Act, Attend, Track*, Track, along with remediation timelines.
Generate consolidated triage reports suitable for ticketing systems and security operations workflows.

Quick Start

Ingest a Nessus CSV export and run the SSVC triage to produce a prioritized remediation plan.

Frequently Asked Questions about ssvc-SKILL.md

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prioritize vulnerability remediation using the SSVC framework?▼

Prioritize vulnerability remediation by applying the CISA SSVC decision tree to scanner results and threat intelligence. The framework evaluates exploitation status, technical impact, automatability, mission prevalence, and public wellbeing to output actionable remediation timelines.

What is the best way to triage CVEs from Nessus or OpenVAS exports?▼

Triage CVEs from Nessus or OpenVAS by ingesting CSV scanner exports and enriching them with KEV, EPSS, and NVD data. This process applies the SSVC decision tree to generate prioritized actions like Act, Attend, Track, and Track* with corresponding SLAs.

Can I use SSVC decision points for security operations ticketing?▼

Yes, you can use SSVC decision points for security operations ticketing by generating consolidated triage reports. These reports provide recommended actions and remediation timelines directly suitable for security operations workflows and ticketing systems.

How does SSVC triage compare to CVSS scoring for vulnerability management?▼

SSVC triage compares to CVSS by shifting from static severity scores to dynamic, risk-based prioritization. While CVSS measures inherent severity, SSVC integrates threat intelligence like KEV and EPSS to produce actionable outcomes like Act or Track based on environmental context.

Does vulnerability triage with SSVC work with asset inventory data?▼

Vulnerability triage with SSVC works with asset inventory data by applying the mission prevalence decision point. Ingesting asset inventory context allows the framework to align risk-based prioritization across CVEs from scanners with your specific operational environment.