[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FD35GDH06JN6DGCXMN0CDG":3,"skill-same:01M6FD35GDH06JN6DGCXMN0CDG":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":25,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":39,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":66,"install":67,"resources":80},"01M6FD35GDH06JN6DGCXMN0CDG","vulnerability-scanning",null,"Scan systems and dependencies for CVEs and security vulnerabilities.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-vulnerability-scanning\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"vulnerability scanning","vulnerability","scanning","community","2026","for","relevant","helper","offensive","scripts","scope","active","scan","main","github","agent-skills","only","vault","devops-security","license","assessment","security","2026-11-10 10:12:30",false,"---\nname: vulnerability-scanning\ndescription: Scan systems and dependencies for CVEs and security vulnerabilities.\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant security tooling (scanners, vault CLIs) and an\n  authorized scope for any active assessment. Docs-only; helper scripts and templates\n  not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# Vulnerability Scanning\n\nIdentify and prioritize security vulnerabilities across infrastructure and applications.\n\n## When to Use This Skill\n\nUse this skill when:\n- Performing security assessments\n- Implementing vulnerability management programs\n- Meeting compliance requirements\n- Triaging and prioritizing remediation\n- Scanning infrastructure for known CVEs\n\n## Prerequisites\n\n- Access to scanning tools\n- Network access to targets\n- Appropriate authorization\n\n## Vulnerability Scanning Tools\n\n| Tool | Type | Best For |\n|------|------|----------|\n| Nessus | Commercial | Enterprise scanning |\n| OpenVAS | Open Source | Free alternative |\n| Qualys | Cloud SaaS | Large scale |\n| Nexpose\u002FInsightVM | Commercial | Asset management |\n| Nuclei | Open Source | Template-based |\n\n## OpenVAS Setup\n\n### Docker Deployment\n\nThe scanner container below is not a complete Greenbone management\u002Fweb stack. Do not expect a web UI or universal admin\u002Fadmin credentials from it. Use the current [official Community Container deployment](https:\u002F\u002Fgreenbone.github.io\u002Fdocs\u002Flatest\u002F22.4\u002Fcontainer\u002F), restrict bindings, initialize credentials privately and verify all component\u002Ffeed health before scans. The legacy OMP examples below illustrate intent only; use the installed GMP tooling and never pass real passwords in command arguments.\n\n```bash\n# Run OpenVAS container\ndocker run -d --name openvas \\\n  -p 443:443 \\\n  -v openvas-data:\u002Fdata \\\n  greenbone\u002Fopenvas-scanner\n\n# Access web UI at https:\u002F\u002Flocalhost\n# Default credentials: admin\u002Fadmin\n```\n\n### Scanning Commands\n\n```bash\n# Create target\nomp -u admin -w admin --xml='\u003Ccreate_target>\n  \u003Cname>Web Servers\u003C\u002Fname>\n  \u003Chosts>192.168.1.0\u002F24\u003C\u002Fhosts>\n\u003C\u002Fcreate_target>'\n\n# Create task\nomp -u admin -w admin --xml='\u003Ccreate_task>\n  \u003Cname>Weekly Scan\u003C\u002Fname>\n  \u003Ctarget id=\"target-uuid\"\u002F>\n  \u003Cconfig id=\"daba56c8-73ec-11df-a475-002264764cea\"\u002F>\n\u003C\u002Fcreate_task>'\n\n# Start task\nomp -u admin -w admin --xml='\u003Cstart_task task_id=\"task-uuid\"\u002F>'\n\n# Get results\nomp -u admin -w admin --xml='\u003Cget_results task_id=\"task-uuid\"\u002F>'\n```\n\n## Nessus\n\n### API Usage\n\n```python\nimport requests\nimport time\n\nclass NessusScanner:\n    def __init__(self, url, access_key, secret_key):\n        self.url = url\n        self.headers = {\n            'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}',\n            'Content-Type': 'application\u002Fjson'\n        }\n    \n    def create_scan(self, name, targets, template='basic'):\n        \"\"\"Create a new scan.\"\"\"\n        templates = self.get('\u002Feditor\u002Fscan\u002Ftemplates')\n        template_uuid = next(\n            t['uuid'] for t in templates['templates'] \n            if t['name'] == template\n        )\n        \n        payload = {\n            'uuid': template_uuid,\n            'settings': {\n                'name': name,\n                'text_targets': targets,\n                'enabled': True\n            }\n        }\n        return self.post('\u002Fscans', payload)\n    \n    def launch_scan(self, scan_id):\n        \"\"\"Start a scan.\"\"\"\n        return self.post(f'\u002Fscans\u002F{scan_id}\u002Flaunch')\n    \n    def get_results(self, scan_id):\n        \"\"\"Get scan results.\"\"\"\n        return self.get(f'\u002Fscans\u002F{scan_id}')\n    \n    def export_report(self, scan_id, format='pdf'):\n        \"\"\"Export scan report.\"\"\"\n        payload = {'format': format}\n        response = self.post(f'\u002Fscans\u002F{scan_id}\u002Fexport', payload)\n        file_id = response['file']\n        \n        # Wait for export\n        for attempt in range(120):\n            status = self.get(f'\u002Fscans\u002F{scan_id}\u002Fexport\u002F{file_id}\u002Fstatus')\n            if status['status'] == 'ready':\n                break\n            time.sleep(5)\n        else:\n            raise TimeoutError('Export not ready; retain file_id before retrying')\n        \n        return self.get(f'\u002Fscans\u002F{scan_id}\u002Fexport\u002F{file_id}\u002Fdownload')\n    \n    def get(self, path):\n        response = requests.get(f'{self.url}{path}', headers=self.headers, timeout=30)\n        response.raise_for_status()\n        return response.json()\n    \n    def post(self, path, data=None):\n        response = requests.post(f'{self.url}{path}', json=data, headers=self.headers, timeout=30)\n        response.raise_for_status()\n        return response.json()\n\n# Usage\nscanner = NessusScanner('https:\u002F\u002Fnessus:8834', 'access-key', 'secret-key')\nscan = scanner.create_scan('Weekly Infrastructure Scan', '10.0.0.0\u002F24')\nscanner.launch_scan(scan['scan']['id'])\n```\n\n## Nuclei\n\n### Installation\n\n```bash\n# Install nuclei\ngo install -v github.com\u002Fprojectdiscovery\u002Fnuclei\u002Fv3\u002Fcmd\u002Fnuclei@latest\n\n# Or download binary\nwget https:\u002F\u002Fgithub.com\u002Fprojectdiscovery\u002Fnuclei\u002Freleases\u002Flatest\u002Fdownload\u002Fnuclei_linux_amd64.zip\nunzip nuclei_linux_amd64.zip\n```\n\n### Basic Scanning\n\n```bash\n# Update templates\nnuclei -update-templates\n\n# Scan single target\nnuclei -u https:\u002F\u002Fexample.com\n\n# Scan multiple targets\nnuclei -l targets.txt\n\n# Scan with specific templates\nnuclei -u https:\u002F\u002Fexample.com -t cves\u002F\nnuclei -u https:\u002F\u002Fexample.com -t vulnerabilities\u002F\n\n# Scan with severity filter\nnuclei -u https:\u002F\u002Fexample.com -s critical,high\n\n# Output formats\nnuclei -u https:\u002F\u002Fexample.com -o results.txt\nnuclei -u https:\u002F\u002Fexample.com -json -o results.json\n```\n\n### Custom Templates\n\n```yaml\n# custom-check.yaml\nid: custom-admin-panel\n\ninfo:\n  name: Admin Panel Detection\n  author: security-team\n  severity: info\n  tags: recon,panel\n\nrequests:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\u002Fadmin\"\n      - \"{{BaseURL}}\u002Fadministrator\"\n      - \"{{BaseURL}}\u002Fwp-admin\"\n    \n    matchers-condition: or\n    matchers:\n      - type: word\n        words:\n          - \"admin\"\n          - \"login\"\n        condition: and\n      \n      - type: status\n        status:\n          - 200\n          - 301\n          - 302\n```\n\nThe Nessus class is illustrative: configure a trusted certificate\u002FCA (never disable verification), check terminal error states, and download report bytes separately rather than calling JSON decoding on a PDF. Keep API keys and report contents out of logs.\n\n## CVSS Scoring\n\n### Severity Levels\n\n| Score | Rating | Response Time |\n|-------|--------|---------------|\n| 9.0-10.0 | Critical | 24 hours |\n| 7.0-8.9 | High | 7 days |\n| 4.0-6.9 | Medium | 30 days |\n| 0.1-3.9 | Low | 90 days |\n\n### Prioritization Factors\n\n```yaml\nprioritization_criteria:\n  critical_factors:\n    - Internet-facing systems\n    - Systems with sensitive data\n    - Active exploitation in the wild\n    - Authentication bypass\n    \n  high_factors:\n    - Remote code execution\n    - Privilege escalation\n    - Data exfiltration risk\n    \n  context_adjustments:\n    - Compensating controls in place (-1)\n    - No direct exposure (-1)\n    - Critical business system (+1)\n    - Compliance requirement (+1)\n```\n\n## Vulnerability Management Process\n\n### Workflow\n\n```yaml\nvulnerability_workflow:\n  discovery:\n    - Run scheduled scans\n    - Import third-party findings\n    - Correlate with asset inventory\n    \n  analysis:\n    - Validate findings\n    - Remove false positives\n    - Assess business impact\n    - Prioritize by risk score\n    \n  remediation:\n    - Assign to owners\n    - Track SLA compliance\n    - Verify fixes\n    - Document exceptions\n    \n  reporting:\n    - Executive summaries\n    - Technical details\n    - Trend analysis\n    - Compliance metrics\n```\n\nResponse-time targets are organizational examples, not universal CVSS requirements. Preserve the original CVSS vector\u002Fversion and describe business priority separately instead of arithmetically modifying the score. Compliance criteria require the current applicable standard and qualified review.\n\n### Tracking Template\n\nThis ticket is fictional; replace CVE, product\u002Fversion and remediation with a verified vendor advisory. Do not infer that the illustrated CVE identifies the described Struts issue.\n\n```markdown\n## Vulnerability Ticket\n\n**ID:** VULN-2024-001\n**CVE:** CVE-2024-12345\n**CVSS:** 9.8 (Critical)\n**Affected System:** web-server-01\n\n### Description\nRemote code execution vulnerability in Apache Struts.\n\n### Impact\nAttacker can execute arbitrary code on the server.\n\n### Remediation\n1. Update Apache Struts to version 2.5.33\n2. Apply WAF rule as temporary mitigation\n\n### Timeline\n- Discovered: 2024-01-15\n- SLA Due: 2024-01-16\n- Remediated: 2024-01-15\n\n### Evidence\n- Scan report: [link]\n- Screenshot: [link]\n```\n\n## CI\u002FCD Integration\n\n### GitHub Actions\n\n```yaml\nname: Vulnerability Scan\n\non:\n  schedule:\n    - cron: '0 2 * * *'\n  push:\n    branches: [main]\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run Nuclei\n        uses: projectdiscovery\u002Fnuclei-action@main\n        with:\n          target: https:\u002F\u002Fexample.com\n          templates: cves\u002F\n          output: nuclei-results.txt\n\n      - name: Check for critical findings\n        run: |\n          if grep -q \"critical\" nuclei-results.txt; then\n            echo \"Critical vulnerabilities found!\"\n            exit 1\n          fi\n\n      - name: Upload results\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: vulnerability-report\n          path: nuclei-results.txt\n```\n\n## Compliance Scanning\n\n### CIS Benchmark Scan\n\n```bash\n# Using OpenSCAP\noscap xccdf eval \\\n  --profile xccdf_org.ssgproject.content_profile_cis \\\n  --results results.xml \\\n  --report report.html \\\n  \u002Fusr\u002Fshare\u002Fxml\u002Fscap\u002Fssg\u002Fcontent\u002Fssg-ubuntu2204-ds.xml\n```\n\n### PCI DSS Scanning\n\n```yaml\npci_scan_requirements:\n  quarterly:\n    - External vulnerability scan (ASV)\n    - Internal vulnerability scan\n    \n  after_changes:\n    - Significant infrastructure changes\n    - New system deployments\n    \n  passing_criteria:\n    - No vulnerabilities rated 4.0+ (CVSS)\n    - False positives documented\n    - Scan completed within 90 days\n```\n\n## Common Issues\n\n### Issue: False Positives\n**Problem**: Scanner reports non-existent vulnerabilities\n**Solution**: Validate manually, tune scanner, maintain exception list\n\n### Issue: Incomplete Coverage\n**Problem**: Not all assets scanned\n**Solution**: Update asset inventory, verify credentials, check network access\n\n### Issue: Scan Impact\n**Problem**: Scans affecting production systems\n**Solution**: Schedule during maintenance windows, use authenticated scans\n\n## Best Practices\n\n- Maintain accurate asset inventory\n- Schedule regular scan cadence\n- Validate findings before remediation\n- Track metrics (MTTR, aging)\n- Integrate with ticketing systems\n- Document exceptions properly\n- Use risk-based prioritization\n- Automate where possible\n\n## Related Skills\n\n- sast-scanning (`sast-scanning`) - Code analysis\n- container-scanning (`container-scanning`) - Container security\n- cis-benchmarks (`cis-benchmarks`) - Compliance benchmarks\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# Vulnerability Scanning\n\nIdentify and prioritize security vulnerabilities across infrastructure and applications.\n\n## When to Use This Skill\n\nUse this skill when:\n- Performing security assessments\n- Implementing vulnerability management programs\n- Meeting compliance requirements\n- Triaging and prioritizing remediation\n- Scanning infrastructure for known CVEs\n\n## Prerequisites\n\n- Access to scanning tools\n- Network access to targets\n- Appropriate authorization\n\n## Vulnerability Scanning Tools\n\n| Tool | Type | Best For |\n|------|------|----------|\n| Nessus | Commercial | Enterprise scanning |\n| OpenVAS | Open Source | Free alternative |\n| Qualys | Cloud SaaS | Large scale |\n| Nexpose\u002FInsightVM | Commercial | Asset management |\n| Nuclei | Open Source | Template-based |\n\n## OpenVAS Setup\n\n### Docker Deployment\n\nThe scanner container below is not a complete Greenbone management\u002Fweb stack. Do not expect a web UI or universal admin\u002Fadmin credentials from it. Use the current [official Community Container deployment](https:\u002F\u002Fgreenbone.github.io\u002Fdocs\u002Flatest\u002F22.4\u002Fcontainer\u002F), restrict bindings, initialize credentials privately and verify all component\u002Ffeed health before scans. The legacy OMP examples below illustrate intent only; use the installed GMP tooling and never pass real passwords in command arguments.\n\n```bash\n# Run OpenVAS container\ndocker run -d --name openvas \\\n  -p 443:443 \\\n  -v openvas-data:\u002Fdata \\\n  greenbone\u002Fopenvas-scanner\n\n# Access web UI at https:\u002F\u002Flocalhost\n# Default credentials: admin\u002Fadmin\n```\n\n### Scanning Commands\n\n```bash\n# Create target\nomp -u admin -w admin --xml='\u003Ccreate_target>\n  \u003Cname>Web Servers\u003C\u002Fname>\n  \u003Chosts>192.168.1.0\u002F24\u003C\u002Fhosts>\n\u003C\u002Fcreate_target>'\n\n# Create task\nomp -u admin -w admin --xml='\u003Ccreate_task>\n  \u003Cname>Weekly Scan\u003C\u002Fname>\n  \u003Ctarget id=\"target-uuid\"\u002F>\n  \u003Cconfig id=\"daba56c8-73ec-11df-a475-002264764cea\"\u002F>\n\u003C\u002Fcreate_task>'\n\n# Start task\nomp -u admin -w admin --xml='\u003Cstart_task task_id=\"task-uuid\"\u002F>'\n\n# Get results\nomp -u admin -w admin --xml='\u003Cget_results task_id=\"task-uuid\"\u002F>'\n```\n\n## Nessus\n\n### API Usage\n\n```python\nimport requests\nimport time\n\nclass NessusScanner:\n    def __init__(self, url, access_key, secret_key):\n        self.url = url\n        self.headers = {\n            'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}',\n            'Content-Type': 'application\u002Fjson'\n        }\n    \n    def create_scan(self, name, targets, template='basic'):\n        \"\"\"Create a new scan.\"\"\"\n        templates = self.get('\u002Feditor\u002Fscan\u002Ftemplates')\n        template_uuid = next(\n            t['uuid'] for t in templates['templates'] \n            if t['name'] == template\n        )\n        \n        payload = {\n            'uuid': template_uuid,\n            'settings': {\n                'name': name,\n                'text_targets': targets,\n                'enabled': True\n            }\n        }\n        return self.post('\u002Fscans', payload)\n    \n    def launch_scan(self, scan_id):\n        \"\"\"Start a scan.\"\"\"\n        return self.post(f'\u002Fscans\u002F{scan_id}\u002Flaunch')\n    \n    def get_results(self, scan_id):\n        \"\"\"Get scan results.\"\"\"\n        return self.get(f'\u002Fscans\u002F{scan_id}')\n    \n    def export_report(self, scan_id, format='pdf'):\n        \"\"\"Export scan report.\"\"\"\n        payload = {'format': format}\n        response = self.post(f'\u002Fscans\u002F{scan_id}\u002Fexport', payload)\n        file_id = response['file']\n        \n        # Wait for export\n        for attempt in range(120):\n            status = self.get(f'\u002Fscans\u002F{scan_id}\u002Fexport\u002F{file_id}\u002Fstatus')\n            if status['status'] == 'ready':\n                break\n            time.sleep(5)\n        else:\n            raise TimeoutError('Export not ready; retain file_id before retrying')\n        \n        return self.get(f'\u002Fscans\u002F{scan_id}\u002Fexport\u002F{file_id}\u002Fdownload')\n    \n    def get(self, path):\n        response = requests.get(f'{self.url}{path}', headers=self.headers, timeout=30)\n        response.raise_for_status()\n        return response.json()\n    \n    def post(self, path, data=None):\n        response = requests.post(f'{self.url}{path}', json=data, headers=self.headers, timeout=30)\n        response.raise_for_status()\n        return response.json()\n\n# Usage\nscanner = NessusScanner('https:\u002F\u002Fnessus:8834', 'access-key', 'secret-key')\nscan = scanner.create_scan('Weekly Infrastructure Scan', '10.0.0.0\u002F24')\nscanner.launch_scan(scan['scan']['id'])\n```\n\n## Nuclei\n\n### Installation\n\n```bash\n# Install nuclei\ngo install -v github.com\u002Fprojectdiscovery\u002Fnuclei\u002Fv3\u002Fcmd\u002Fnuclei@latest\n\n# Or download binary\nwget https:\u002F\u002Fgithub.com\u002Fprojectdiscovery\u002Fnuclei\u002Freleases\u002Flatest\u002Fdownload\u002Fnuclei_linux_amd64.zip\nunzip nuclei_linux_amd64.zip\n```\n\n### Basic Scanning\n\n```bash\n# Update templates\nnuclei -update-templates\n\n# Scan single target\nnuclei -u https:\u002F\u002Fexample.com\n\n# Scan multiple targets\nnuclei -l targets.txt\n\n# Scan with specific templates\nnuclei -u https:\u002F\u002Fexample.com -t cves\u002F\nnuclei -u https:\u002F\u002Fexample.com -t vulnerabilities\u002F\n\n# Scan with severity filter\nnuclei -u https:\u002F\u002Fexample.com -s critical,high\n\n# Output formats\nnuclei -u https:\u002F\u002Fexample.com -o results.txt\nnuclei -u https:\u002F\u002Fexample.com -json -o results.json\n```\n\n### Custom Templates\n\n```yaml\n# custom-check.yaml\nid: custom-admin-panel\n\ninfo:\n  name: Admin Panel Detection\n  author: security-team\n  severity: info\n  tags: recon,panel\n\nrequests:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\u002Fadmin\"\n      - \"{{BaseURL}}\u002Fadministrator\"\n      - \"{{BaseURL}}\u002Fwp-admin\"\n    \n    matchers-condition: or\n    matchers:\n      - type: word\n        words:\n          - \"admin\"\n          - \"login\"\n        condition: and\n      \n      - type: status\n        status:\n          - 200\n          - 301\n          - 302\n```\n\nThe Nessus class is illustrative: configure a trusted certificate\u002FCA (never disable verification), check terminal error states, and download report bytes separately rather than calling JSON decoding on a PDF. Keep API keys and report contents out of logs.\n\n## CVSS Scoring\n\n### Severity Levels\n\n| Score | Rating | Response Time |\n|-------|--------|---------------|\n| 9.0-10.0 | Critical | 24 hours |\n| 7.0-8.9 | High | 7 days |\n| 4.0-6.9 | Medium | 30 days |\n| 0.1-3.9 | Low | 90 days |\n\n### Prioritization Factors\n\n```yaml\nprioritization_criteria:\n  critical_factors:\n    - Internet-facing systems\n    - Systems with sensitive data\n    - Active exploitation in the wild\n    - Authentication bypass\n    \n  high_factors:\n    - Remote code execution\n    - Privilege escalation\n    - Data exfiltration risk\n    \n  context_adjustments:\n    - Compensating controls in place (-1)\n    - No direct exposure (-1)\n    - Critical business system (+1)\n    - Compliance requirement (+1)\n```\n\n## Vulnerability Management Process\n\n### Workflow\n\n```yaml\nvulnerability_workflow:\n  discovery:\n    - Run scheduled scans\n    - Import third-party findings\n    - Correlate with asset inventory\n    \n  analysis:\n    - Validate findings\n    - Remove false positives\n    - Assess business impact\n    - Prioritize by risk score\n    \n  remediation:\n    - Assign to owners\n    - Track SLA compliance\n    - Verify fixes\n    - Document exceptions\n    \n  reporting:\n    - Executive summaries\n    - Technical details\n    - Trend analysis\n    - Compliance metrics\n```\n\nResponse-time targets are organizational examples, not universal CVSS requirements. Preserve the original CVSS vector\u002Fversion and describe business priority separately instead of arithmetically modifying the score. Compliance criteria require the current applicable standard and qualified review.\n\n### Tracking Template\n\nThis ticket is fictional; replace CVE, product\u002Fversion and remediation with a verified vendor advisory. Do not infer that the illustrated CVE identifies the described Struts issue.\n\n```markdown\n## Vulnerability Ticket\n\n**ID:** VULN-2024-001\n**CVE:** CVE-2024-12345\n**CVSS:** 9.8 (Critical)\n**Affected System:** web-server-01\n\n### Description\nRemote code execution vulnerability in Apache Struts.\n\n### Impact\nAttacker can execute arbitrary code on the server.\n\n### Remediation\n1. Update Apache Struts to version 2.5.33\n2. Apply WAF rule as temporary mitigation\n\n### Timeline\n- Discovered: 2024-01-15\n- SLA Due: 2024-01-16\n- Remediated: 2024-01-15\n\n### Evidence\n- Scan report: [link]\n- Screenshot: [link]\n```\n\n## CI\u002FCD Integration\n\n### GitHub Actions\n\n```yaml\nname: Vulnerability Scan\n\non:\n  schedule:\n    - cron: '0 2 * * *'\n  push:\n    branches: [main]\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run Nuclei\n        uses: projectdiscovery\u002Fnuclei-action@main\n        with:\n          target: https:\u002F\u002Fexample.com\n          templates: cves\u002F\n          output: nuclei-results.txt\n\n      - name: Check for critical findings\n        run: |\n          if grep -q \"critical\" nuclei-results.txt; then\n            echo \"Critical vulnerabilities found!\"\n            exit 1\n          fi\n\n      - name: Upload results\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: vulnerability-report\n          path: nuclei-results.txt\n```\n\n## Compliance Scanning\n\n### CIS Benchmark Scan\n\n```bash\n# Using OpenSCAP\noscap xccdf eval \\\n  --profile xccdf_org.ssgproject.content_profile_cis \\\n  --results results.xml \\\n  --report report.html \\\n  \u002Fusr\u002Fshare\u002Fxml\u002Fscap\u002Fssg\u002Fcontent\u002Fssg-ubuntu2204-ds.xml\n```\n\n### PCI DSS Scanning\n\n```yaml\npci_scan_requirements:\n  quarterly:\n    - External vulnerability scan (ASV)\n    - Internal vulnerability scan\n    \n  after_changes:\n    - Significant infrastructure changes\n    - New system deployments\n    \n  passing_criteria:\n    - No vulnerabilities rated 4.0+ (CVSS)\n    - False positives documented\n    - Scan completed within 90 days\n```\n\n## Common Issues\n\n### Issue: False Positives\n**Problem**: Scanner reports non-existent vulnerabilities\n**Solution**: Validate manually, tune scanner, maintain exception list\n\n### Issue: Incomplete Coverage\n**Problem**: Not all assets scanned\n**Solution**: Update asset inventory, verify credentials, check network access\n\n### Issue: Scan Impact\n**Problem**: Scans affecting production systems\n**Solution**: Schedule during maintenance windows, use authenticated scans\n\n## Best Practices\n\n- Maintain accurate asset inventory\n- Schedule regular scan cadence\n- Validate findings before remediation\n- Track metrics (MTTR, aging)\n- Integrate with ticketing systems\n- Document exceptions properly\n- Use risk-based prioritization\n- Automate where possible\n\n## Related Skills\n\n- sast-scanning (`sast-scanning`) - Code analysis\n- container-scanning (`container-scanning`) - Container security\n- cis-benchmarks (`cis-benchmarks`) - Compliance benchmarks\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":34,"source":53,"license":14,"category":47,"metadata":54,"date_added":57,"description":7,"source_repo":58,"source_type":29,"compatibility":59,"license_source":60},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills",{"author":55,"version":56},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-vulnerability-scanning",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-11 14:20:43",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add boisenoise\u002Fskills-collections --skill vulnerability-scanning",{"tool":73,"command":74},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill vulnerability-scanning",{"tool":76,"command":77},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill vulnerability-scanning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-vulnerability-scanning\u002FSKILL.md",true,[],[82,110,132,157,176,199],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":86,"licenseFileUrl":87,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":48},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[91,92,93,94,95,96,97,98,99,100,101,42,102,103,104,105,106,107,108,109,30],"web","access","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":86,"licenseFileUrl":114,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":48},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[117],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[112,119,120,40,94,95,45,99,121,122,123,124,125,126,127,105,128,129,130,131,30],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":86,"licenseFileUrl":136,"sourceHtmlUrl":137,"categories":138,"keywords":144,"publishedAt":48},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[139],{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[134,40,94,45,145,146,147,148,149,150,105,151,152,153,129,31,154,155,156,131,112,30],"https","email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":86,"licenseFileUrl":161,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":48},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[165,166,167,40,94,45,168,169,145,170,121,171,172,173,149,105,174,175,131,112,30],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":86,"licenseFileUrl":180,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":48},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[184,185,40,186,94,187,45,188,189,190,191,192,105,193,194,195,196,197,198,131],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":86,"licenseFileUrl":203,"sourceHtmlUrl":204,"categories":205,"keywords":206,"publishedAt":48},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[207,208,209,40,94,45,210,211,148,212,213,105,214,215,216,217,218,219,220,131],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]