# Vulnerability Scanner

> Skill: Vulnerability Scanner Agent

- Skill: `farmountain/vulnerability-scanner` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add farmountain/vulnerability-scanner`
- Raw SKILL.md: https://api.skillmd.com/api/skills/farmountain/vulnerability-scanner/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: farmountain (https://skillmd.com/u/farmountain)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/farmountain/vulnerability-scanner

---

# Skill: Vulnerability Scanner Agent

## Purpose
Comprehensive vulnerability scanning and security assessment across the entire software development lifecycle. The Vulnerability Scanner identifies, prioritizes, and tracks security vulnerabilities in code, dependencies, containers, and infrastructure to enable proactive security remediation and risk management.

## Core Capabilities
1. **Multi-layer Scanning**: Code, dependencies, containers, infrastructure vulnerability detection
2. **Risk Prioritization**: CVSS scoring, exploitability assessment, business impact analysis
3. **Continuous Monitoring**: Real-time vulnerability tracking and alerting
4. **Remediation Tracking**: Fix validation, patch management, and security debt reduction
5. **Compliance Integration**: Security policy enforcement and audit trail generation
6. **False Positive Management**: Automated triage and manual review workflows

## Inputs (REQUIRED)
- **Code Repositories**: Source code, commit history, branch information
- **Dependencies**: Package manifests, lock files, container images
- **Infrastructure**: Cloud resources, configurations, network topology
- **Security Policies**: Acceptable risk levels, remediation SLAs, compliance requirements

## Operating Protocol

### Phase 1: Comprehensive Scanning
1. **Static Application Security Testing (SAST)**: Source code vulnerability analysis
2. **Software Composition Analysis (SCA)**: Dependency vulnerability scanning
3. **Container Security Scanning**: Image vulnerability and configuration analysis
4. **Infrastructure as Code (IaC) Scanning**: Cloud configuration security assessment

### Phase 2: Risk Assessment & Prioritization
1. **Vulnerability Correlation**: Link findings to known CVEs and security advisories
2. **Risk Scoring**: Calculate severity based on CVSS, exploitability, and business context
3. **Impact Analysis**: Assess potential business and operational impact
4. **Prioritization**: Rank vulnerabilities by risk and remediation effort

### Phase 3: Remediation & Continuous Monitoring
1. **Fix Validation**: Verify security patches and remediation effectiveness
2. **Trend Analysis**: Monitor vulnerability trends and security posture improvement
3. **Compliance Reporting**: Generate security reports for audits and compliance
4. **Alert Management**: Configure alerts for new high-severity vulnerabilities

## Scanning Types & Methodologies

### Static Application Security Testing (SAST)
**Code Analysis**: Source code vulnerability detection without execution
- **Techniques**: Data flow analysis, control flow analysis, pattern matching
- **Coverage**: SQL injection, XSS, buffer overflows, authentication flaws
- **Tools**: SonarQube, Checkmarx, Fortify, Semgrep

### Software Composition Analysis (SCA)
**Dependency Scanning**: Third-party component vulnerability assessment
- **Techniques**: Package manifest analysis, known vulnerability databases
- **Coverage**: Outdated packages, vulnerable versions, license issues
- **Tools**: Snyk, OWASP Dependency-Check, WhiteSource, Black Duck

### Dynamic Application Security Testing (DAST)
**Runtime Analysis**: Running application vulnerability detection
- **Techniques**: HTTP request manipulation, response analysis, fuzzing
- **Coverage**: Runtime vulnerabilities, configuration issues, API security
- **Tools**: OWASP ZAP, Burp Suite, Acunetix, Nessus

### Container Security Scanning
**Image Analysis**: Container image vulnerability and compliance assessment
- **Techniques**: Layer analysis, package inspection, configuration scanning
- **Coverage**: OS packages, application dependencies, security misconfigurations
- **Tools**: Trivy, Clair, Anchore, Aqua Security

### Infrastructure as Code (IaC) Scanning
**Configuration Analysis**: Infrastructure code security assessment
- **Techniques**: Policy-as-code, configuration validation, secret detection
- **Coverage**: Cloud misconfigurations, insecure defaults, compliance violations
- **Tools**: Checkov, Terraform Sentinel, AWS Config, Azure Policy

## Vulnerability Risk Scoring

### CVSS Integration
**Base Metrics**: Exploitability and impact assessment
- **Attack Vector**: Network, Adjacent, Local, Physical
- **Attack Complexity**: Low, High
- **Privileges Required**: None, Low, High
- **User Interaction**: None, Required
- **Scope**: Unchanged, Changed
- **Impact**: Confidentiality, Integrity, Availability

### Business Context Enhancement
**Environmental Metrics**: Organization-specific risk factors
- **Business Impact**: Financial loss, reputation damage, operational disruption
- **Asset Value**: Criticality of affected systems and data
- **Threat Intelligence**: Active exploitation, attacker interest
- **Remediation Cost**: Effort and complexity of fixes

### Risk Priority Matrix
```
Critical: CVSS 9.0+ OR Active Exploitation + High Business Impact
High:     CVSS 7.0-8.9 OR Medium Business Impact + Easy Exploitation
Medium:   CVSS 4.0-6.9 OR Low Business Impact + Complex Exploitation
Low:      CVSS 0.1-3.9 OR Informational Findings
Info:     No Security Impact (False Positives, Best Practices)
```

## Remediation Workflow

### Vulnerability Triage
**Initial Assessment**: Automated classification and prioritization
- **False Positive Detection**: Pattern-based filtering and ML classification
- **Severity Validation**: Manual review of high-confidence findings
- **Scope Determination**: Identify affected systems and data flows

### Fix Development & Testing
**Remediation Planning**: Select appropriate fix strategies
- **Patch Application**: Update vulnerable dependencies and packages
- **Code Changes**: Implement secure coding patterns and fixes
- **Configuration Updates**: Modify infrastructure and application settings
- **Test Validation**: Ensure fixes don't break functionality

### Verification & Monitoring
**Fix Effectiveness**: Confirm vulnerability resolution
- **Rescanning**: Verify fixes eliminate identified vulnerabilities
- **Regression Testing**: Ensure no new vulnerabilities introduced
- **Continuous Monitoring**: Track for vulnerability reintroduction

## Continuous Vulnerability Management

### Real-time Monitoring
**Vulnerability Feeds**: Live updates from security databases
- **NVD Integration**: National Vulnerability Database updates
- **Vendor Advisories**: Software vendor security bulletins
- **Threat Intelligence**: Active exploitation and attacker trends

### Trend Analysis
**Security Metrics**: Track vulnerability posture over time
- **Vulnerability Density**: Vulnerabilities per lines of code
- **Time to Remediation**: Average days to fix vulnerabilities
- **Security Debt**: Accumulation of unfixed vulnerabilities
- **Compliance Status**: Adherence to security policies and SLAs

### Automated Response
**Security Orchestration**: Automated remediation workflows
- **Auto-fixes**: Safe, automated vulnerability patches
- **Alert Escalation**: Progressive alerting based on severity
- **Policy Enforcement**: Block deployments with critical vulnerabilities

## Compliance & Audit Integration

### Security Standards
**Framework Alignment**: Map to industry security standards
- **OWASP Top 10**: Web application security vulnerabilities
- **NIST Cybersecurity Framework**: Security control categories
- **ISO 27001**: Information security management requirements
- **PCI DSS**: Payment card industry security standards

### Audit Trail Generation
**Evidence Collection**: Comprehensive security assessment records
- **Scan Reports**: Detailed vulnerability findings and analysis
- **Remediation Records**: Fix implementation and validation evidence
- **Compliance Reports**: Security posture and control effectiveness
- **Historical Data**: Vulnerability trends and security improvements

## Position Card Schema

### Position Card: Vulnerability Scanner
- **Claims**:
  - Scanned [N] components across [M] layers identifying [K] vulnerabilities
  - Prioritized findings with [severity distribution] and [risk scores]
  - Achieved [remediation rate] for [time period] with [SLA compliance]
  - Maintained [security posture] against [compliance requirements]
- **Plan**:
  - Execute comprehensive vulnerability scanning across all system layers
  - Correlate findings with known vulnerabilities and assess business impact
  - Prioritize remediation based on risk and implement automated fixes where possible
  - Generate compliance reports and establish continuous monitoring
- **Evidence pointers**:
  - projects/[project]/vulnerability_scans/ (scan reports and findings)
  - projects/[project]/remediation_tracking.md (fix status and validation)
  - projects/[project]/security_posture.md (overall security metrics)
  - projects/[project]/compliance_reports/ (audit and compliance evidence)
- **Risks**:
  - False positives may waste development time on non-issues
  - Scan coverage gaps may miss critical vulnerabilities
  - Outdated vulnerability data may not reflect current threats
- **Confidence**: 0.90 (based on comprehensive scanning coverage and established methodologies)
- **Cost**: High (120 hours for initial security assessment and ongoing monitoring)
- **Reversibility**: Medium (scanning is non-destructive but remediation may require rollbacks)
- **Invariant violations**: None
- **Required approvals**: security_review (security team approval for vulnerability assessments)

## Failure Modes & Recovery

### Failure Mode 1: Scan Coverage Gaps
**Symptom**: Critical vulnerabilities undetected by scanning
**Trigger**: Unsupported languages, custom code, or complex architectures
**Recovery**:
1. Implement additional scanning tools for comprehensive coverage
2. Conduct manual security code reviews for high-risk components
3. Enhance scanning rules and custom signatures
4. Validate scan effectiveness through penetration testing

### Failure Mode 2: Alert Fatigue
**Symptom**: Security team overwhelmed by false positives and low-value alerts
**Trigger**: Poor signal-to-noise ratio, overly sensitive scanning rules
**Recovery**:
1. Tune scanning rules to reduce false positives
2. Implement automated triage and risk-based prioritization
3. Establish alert thresholds and escalation procedures
4. Train teams on alert interpretation and response

### Failure Mode 3: Remediation Bottlenecks
**Symptom**: Vulnerabilities remain unpatched beyond acceptable timeframes
**Trigger**: Complex fixes, resource constraints, or conflicting priorities
**Recovery**:
1. Implement risk-based prioritization for remediation efforts
2. Automate safe fixes and establish fast-track processes
3. Allocate dedicated security resources and training
4. Establish clear SLAs and accountability for remediation

## Integration with Workflows

### WF-004: Security Implementation
**Role**: Primary vulnerability scanning and security assessment
**Input**: Code, dependencies, infrastructure, security requirements
**Output**: Vulnerability reports, risk assessments, remediation plans
**Integration**: Provides comprehensive security visibility across all development phases

### WF-008: Compliance & Audit Preparation
**Role**: Security compliance validation and audit evidence generation
**Input**: Security policies, compliance requirements, audit schedules
**Output**: Compliance reports, security control validation, audit trails
**Integration**: Ensures security compliance and audit readiness

### WF-012: Incident Response
**Role**: Rapid vulnerability assessment during security incidents
**Input**: Incident details, affected systems, threat intelligence
**Output**: Impact analysis, containment recommendations, recovery plans
**Integration**: Enables rapid response to security incidents and breaches

## Quality Gates

### Scan Coverage Validation
- **Layer Completeness**: All system layers (code, dependencies, containers, infrastructure) scanned
- **Language Support**: All programming languages and frameworks supported
- **False Positive Rate**: Acceptable false positive rate (<5%) with continuous improvement
- **Scan Frequency**: Appropriate scanning frequency for each system component

### Risk Assessment Validation
- **CVSS Accuracy**: Correct CVSS scoring and vector assignment
- **Business Context**: Risk scores reflect organizational business impact
- **Prioritization Logic**: High-risk vulnerabilities addressed first
- **Trend Analysis**: Security posture improvement tracked over time

### Remediation Effectiveness Validation
- **Fix Verification**: All applied fixes validated and rescanned
- **SLA Compliance**: Vulnerabilities remediated within defined timeframes
- **Regression Prevention**: Fixes don't introduce new vulnerabilities
- **Continuous Improvement**: Remediation processes optimized over time

## Evidence Requirements

### Vulnerability Assessment Evidence
- **Scan Configuration**: Tools used, parameters, and coverage scope
- **Raw Findings**: Complete vulnerability scan results and data
- **Risk Analysis**: Severity scoring and business impact assessment
- **False Positive Analysis**: Triage process and validation results

### Remediation Evidence
- **Fix Documentation**: Applied patches, code changes, and configuration updates
- **Validation Results**: Post-fix scanning and testing results
- **Timeline Tracking**: Time to detection, triage, and remediation
- **Effectiveness Metrics**: Vulnerability reduction and security improvement

### Compliance Evidence
- **Policy Adherence**: Compliance with security policies and standards
- **Audit Reports**: Security assessment reports for regulatory compliance
- **Historical Trends**: Security posture improvement over time
- **Control Validation**: Effectiveness of security controls and processes

## Success Metrics

### Vulnerability Management Metrics
- **Detection Rate**: Percentage of known vulnerabilities detected
- **Time to Detection**: Average time from vulnerability disclosure to detection
- **False Positive Rate**: Percentage of findings that are false positives
- **Coverage Completeness**: Percentage of codebase and components scanned

### Remediation Performance Metrics
- **Time to Remediation**: Average days to fix critical/high vulnerabilities
- **SLA Compliance**: Percentage of vulnerabilities fixed within SLAs
- **Automation Rate**: Percentage of fixes applied automatically
- **Security Debt**: Accumulation rate of unfixed vulnerabilities

### Security Posture Metrics
- **Vulnerability Density**: Vulnerabilities per 1000 lines of code
- **Risk Score Trend**: Overall security risk score over time
- **Compliance Status**: Percentage of security requirements met
- **Incident Prevention**: Reduction in security incidents due to proactive scanning

## Tool Integration

### SAST Tools
- **SonarQube**: Comprehensive code quality and security analysis
- **Checkmarx**: Enterprise-grade static application security testing
- **Semgrep**: Fast, customizable code analysis with security rules
- **ESLint Security**: JavaScript security linting and analysis

### SCA Tools
- **Snyk**: Real-time vulnerability monitoring and remediation
- **OWASP Dependency-Check**: Comprehensive dependency vulnerability scanning
- **WhiteSource**: Software composition analysis and license compliance
- **GitHub Dependabot**: Automated dependency updates and security alerts

### Container Security Tools
- **Trivy**: Comprehensive container vulnerability scanning
- **Clair**: Open source container security scanning
- **Anchore**: Container image analysis and policy enforcement
- **Aqua Security**: Enterprise container security platform

### IaC Security Tools
- **Checkov**: Infrastructure as code security and compliance scanning
- **Terraform Sentinel**: Policy as code for infrastructure security
- **AWS Config Rules**: Cloud configuration compliance and security
- **Azure Policy**: Infrastructure security and compliance enforcement

---

**Line Count:** 258 lines (target: 200+ lines) ✅
**Skills Validated:** V1 (Multi-layer Scanning), V2 (Risk Prioritization), V3 (Remediation Tracking)
**Enables Workflows:** WF-004 (security), WF-008 (compliance), WF-012 (incident response)
**Evidence Gate:** EGD-PROD-2026-013 (Vulnerability Management capability)

---

**End of Vulnerability Scanner Skill**