vulnerability-disclosure-and-retest-manager

Manage privacy-audit finding remediation, disclosure drafting, retest planning, and audit closure.

2|Updated May 6, 2026

Search Tags:#security audit #cvss #remediation tracking #vulnerability disclosure #privacy audit #retest management #finding register

Ready to run

npx skills add https://github.com/bpcakes/jig-skills --skill vulnerability-disclosure-and-retest-manager-bpcakes

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: vulnerability-disclosure-and-retest-manager
Source: https://github.com/bpcakes/jig-skills/tree/main/plugins/jig-privacy-audit/skills/vulnerability-disclosure-and-retest-manager
Command: npx skills add https://github.com/bpcakes/jig-skills --skill vulnerability-disclosure-and-retest-manager-bpcakes

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? After a privacy audit produces findings, teams struggle to track remediation, deduplicate overlapping reports, plan retests, and coordinate disclosure. This Skill manages the full finding lifecycle from normalization through final audit closure. ## Core Features & Use Cases - Finding Register Management: Normalize, deduplicate, and track findings from multiple audit skills in a machine-readable JSON register with severity, confidence, and status history. - Retest Planning and Execution: Generate concrete retest steps, track fix commits, rerun affected audit skills, and enforce strict status rules (open, fixed, partially_fixed, accepted_risk, not_reproducible). - Disclosure Coordination: Draft coordinated vendor disclosure, public advisories, or internal remediation summaries with embargo-sensitive handling and timeline tracking. - Use Case: After running crypto and network privacy audits, import all findings into a register, mark a finding partially_fixed with its fix commit, and generate a final audit summary showing residual risks by severity. ## Quick Start Ask the agent to import your privacy audit findings into a retest register, update the status of a specific finding with its fix commit, and generate a final audit summary.

Frequently Asked Questions about vulnerability-disclosure-and-retest-manager

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I track remediation of privacy audit findings?▼

Import findings into a JSON retest register using the vdrm_register.py script, then update each finding's status with fix commits and notes as remediation progresses. The register tracks severity, confidence, evidence, retest steps, and full status history.

How do I deduplicate overlapping security findings from multiple audits?▼

The register script deduplicates findings that share the same root cause, affected asset, and remediation by computing a dedupe key. Duplicates are merged into one canonical finding retaining all source IDs, union of evidence, highest severity, and lowest confidence.

What statuses can a vulnerability finding have during retesting?▼

Findings use exactly five statuses: open, fixed, partially_fixed, accepted_risk, and not_reproducible. A finding cannot be marked fixed from code review alone when runtime behavior, deployment, or data cleanup was part of the original issue.

Does this skill run the actual security retests automatically?▼

No, the register script is a tracking helper, not a verifier. Manual retest evidence controls status; the skill routes retests to the original audit skills such as crypto-architecture-review or network-payload-zero-knowledge-test when authorized.

When should I not use a finding register for audit management?▼

Do not use it to replace the original technical audit that found the issue, and do not start tracking, disclosure, or retesting merely because findings exist. It activates only when the user explicitly requests remediation tracking, disclosure drafting, retest planning, or audit closure.