vulnerability-management

Score CVSS v3.1 and EPSS vulnerabilities and track SLA-based remediation.

3|3|Updated Mar 8, 2026

Search Tags:#vulnerability management #cvss #cve #patching #risk prioritization #epss

Ready to run

npx skills add https://github.com/jaskaranhundal/usap-skills --skill vulnerability-management-jaskaranhundal

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: vulnerability-management
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/governance/vulnerability-management
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill vulnerability-management-jaskaranhundal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the critical task of prioritizing software vulnerabilities, ensuring that the most dangerous threats are addressed first, thereby reducing an organization's attack surface and potential for breaches.

Core Features & Use Cases

Risk-Based Prioritization: Scores vulnerabilities using CVSS, EPSS, and asset criticality to determine true risk.
Automated SLA Tracking: Assigns and tracks remediation deadlines based on severity and exploitability.
Remediation Guidance: Recommends specific actions like patching, configuration changes, or risk acceptance.
Use Case: When a new critical CVE is published, this Skill will immediately assess its exploitability and impact on your critical assets, recommending whether to patch within 24 hours or apply a compensating control.

Quick Start

Use the vulnerability-management skill to analyze CVE-2024-12345 and recommend a remediation path.

Frequently Asked Questions about vulnerability-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prioritize vulnerability patching using CVSS and EPSS scoring?▼

Vulnerability prioritization combines CVSS v3.1 severity metrics with EPSS exploitability scores and asset criticality to calculate true risk. This evidence-based approach assigns SLA-based remediation deadlines, ensuring the most exploitable threats on critical assets are patched first.

What is risk-based vulnerability management and when do I need it?▼

Risk-based vulnerability management is the process of scoring threats by exploitability and impact rather than severity alone. You need it when facing high volumes of CVEs to reduce your attack surface by filtering noise and focusing remediation efforts on immediately exploitable vulnerabilities.

Can I use vulnerability management for read-only CVE analysis without applying patches?▼

Yes, the skill supports read-only analysis intent classifications, allowing you to assess CVE exploitability and score severity without triggering mutating remediation actions. This enables safe evaluation of vulnerabilities before committing to any environment changes.

Does vulnerability management track SLA deadlines for remediation actions?▼

Yes, the skill assigns and tracks automated SLA-based remediation deadlines determined by vulnerability severity and exploitability scores. This ensures compliance with internal patching policies and provides continuous tracking from discovery through resolution.

What is the best way to handle vulnerabilities on non-critical assets?▼

For non-critical assets, the skill evaluates CVSS and EPSS scores to recommend compensating controls or formal risk acceptance instead of immediate patching. This risk-based approach optimizes remediation resources by avoiding unnecessary patches for low-exploitability threats.