skills.rest
hung-phan
hung-phanCOMMUNITY
Explore all skills by this author →
GitHub

vulnerability-management

Prioritize CVEs using CVSS, EPSS, KEV, and reachability analysis.

Updated Jun 5, 2026
Search Tags:#vulnerability management#SAST#SCA#SBOM#CVE triage
One-click install
npx skills add https://github.com/hung-phan/system-skills --skill vulnerability-management-hung-phan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-management
Source: https://github.com/hung-phan/system-skills/tree/main/skills/system-review/references/security/vulnerability-management
Command: npx skills add https://github.com/hung-phan/system-skills --skill vulnerability-management-hung-phan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps manage and prioritize security vulnerabilities in production systems, offering a structured approach to CVE triage, SCA, SAST, and patch SLAs.

Core Features & Use Cases

  • CVE Triage: Prioritize CVEs based on CVSS, EPSS, and KEV, along with reachability and blast radius analysis.
  • SCA and SAST Integration: Automate the identification of vulnerable dependencies and code.
  • Secret Scanning: Scan for and manage secret exposure.
  • SBOM Generation: Generate and consume SBOMs for supply chain security.
  • Use Case: When faced with a flood of CVEs and uncertain about which ones pose the most significant risk, this Skill helps identify and prioritize them for remediation.

Quick Start

Use the vulnerability-management skill to review a new CVE and prioritize it for remediation.

Frequently Asked Questions about vulnerability-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prioritize CVEs for remediation when faced with a flood of security vulnerabilities?▼

Prioritize CVEs for remediation by evaluating them based on a combination of CVSS, EPSS, KEV, and reachability. This structured triage approach helps identify which security vulnerabilities pose the most significant risk in production systems.

What is the best way to triage CVEs using EPSS and KEV data?▼

Triage CVEs by combining CVSS, EPSS, and KEV data alongside reachability and blast radius analysis. This structured method efficiently manages security vulnerabilities and prioritizes patching efforts in production systems.

Can I use this approach for SCA and SAST integration to automate vulnerable dependency identification?▼

Yes, this vulnerability management approach applies to SCA and SAST integration to automate the identification of vulnerable dependencies and code. It also extends to secret scanning and SBOM generation for supply chain security.

How do I generate and consume SBOMs for software supply chain security?▼

Generate and consume SBOMs as part of a structured vulnerability management process covering SCA, SAST, and secret scanning. This approach ensures comprehensive supply chain security and helps manage patch SLAs effectively.

Does CVE triage require reachability and blast radius analysis for production systems?▼

Yes, effective CVE triage in production systems requires analyzing reachability and blast radius alongside CVSS, EPSS, and KEV scores. This combination accurately identifies and prioritizes security vulnerabilities for remediation.

Related Skills

RHEcosystemAppEngRHEcosystemAppEng
48

container-cve-validator

Validates CVEs against Red Hat container images using SBOM attestations and VEX data.

Official
Advanced
ConsiliencyConsiliency
8

security-audit

Scan codebases for OWASP vulnerabilities and generate prioritized remediation reports.

Official
Intermediate
jaskaranhundaljaskaranhundal
3

sast-dast-coordinator

Orchestrate SAST, DAST, SCA, and secrets scanning tools to correlate and prioritize findings.

Community
Advanced
zebbernzebbern
5

triage-findings

Deduplicate and prioritize vulnerability findings using CVSS, EPSS, and KEV context.

Community
Advanced