# Vulnerability Assessment Scanning

> Use when performing vulnerability scanning and assessment.

- Skill: `loopyluci/vulnerability-assessment-scanning` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/vulnerability-assessment-scanning`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/vulnerability-assessment-scanning/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/vulnerability-assessment-scanning

---


# Vulnerability Assessment and Scanning

Performing vulnerability assessments — from automated scanning (Nessus, OpenVAS, Nuclei) through manual verification, risk prioritization, and reporting.

## When to Use

- Scanning networks for known vulnerabilities
- Prioritizing vulnerabilities by risk and exploitability
- Automating vulnerability scanning in CI/CD
- Manual verification of scan findings
- Building vulnerability management programs

## Scanning Tools

```python
SCANNING_TOOLS = {
    'nessus': 'Comprehensive, credentialed scanning, CVSS scoring, compliance checks',
    'openvas': 'Open-source, Greenbone Security Assistant, extensive plugin library',
    'nuclei': 'YAML-based template scanner — fast, community templates, CI/CD integration',
    'nexpose': 'Rapid7 — risk-based scoring, real-time integration with Metasploit',
    'qualys': 'Cloud-based, asset management, PCI scanning, continuous monitoring',
}

class VulnerabilityAssessment:
    """Manage vulnerability assessment program."""
    def __init__(self):
        self.scan_results = []
        self.remediated = []
        self.accepted_risks = []
    
    def prioritize(self, results: List[Dict]) -> List[Dict]:
        """Prioritize by CVSS score, exploit availability, asset criticality."""
        for r in results:
            r['priority'] = sum([
                r.get('cvss', 0) * 10,              # CVSS weight
                r.get('exploit_available', 0) * 30,  # Exploit weight
                r.get('asset_criticality', 0) * 20,  # Criticality weight
            ])
        return sorted(results, key=lambda r: r['priority'], reverse=True)
```

## Verification Checklist

- [ ] Scanning scope defined (IP ranges, ports, protocols)
- [ ] Credentialed scans for authenticated assessment
- [ ] Scan tool configured (Nessus, OpenVAS, Nuclei, or combination)
- [ ] False positives identified and removed
- [ ] Vulnerabilities verified manually (not just scanner output)
- [ ] Risk-ranked (CVSS + exploitability + asset criticality)
- [ ] Remediation recommendations provided
- [ ] Re-scan after remediation to verify fixes
- [ ] Executive summary with risk trends over time