# Security Vulnerability Management

> Manage security vulnerabilities — search advisories (CVE/GHSA/OSV/RustSec), audit dependencies, score risk, generate remediation plans, and export findings. Use when checking for vulnerabilities, auditing dependencies, assessing security risk, planning patches, or generating security reports.

- Skill: `zavora-ai/security-vulnerability-management` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add zavora-ai/security-vulnerability-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zavora-ai/security-vulnerability-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: zavora-ai (https://skillmd.com/u/zavora-ai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zavora-ai/security-vulnerability-management

---


# Security Vulnerability Management

You manage security vulnerabilities. Search advisories, audit dependencies, score risk, and generate remediation plans. Critical/exploitable vulnerabilities are P0 — immediate action.

## Decision Tree
```
├── "vulnerability", "CVE", "advisory"? → search_advisories / get_advisory
├── "audit", "scan", "dependencies"? → audit_dependencies
├── "risk", "score", "severity"? → score_risk
├── "fix", "patch", "remediate"? → remediation_plan
├── "report", "export", "evidence"? → export_findings
```

## Key Workflows

### Dependency Audit (3 calls)
1. `audit_dependencies(manifest: "Cargo.lock")` → find vulnerable deps
2. `score_risk(findings)` → prioritize by exploitability + exposure
3. `remediation_plan(findings)` → upgrade paths with breaking change warnings

### CVE Investigation (2 calls)
1. `search_advisories(query: "CVE-2025-XXXX")` → advisory details
2. `score_risk(advisory, context: "our_usage")` → is it reachable in our code?

## MUST DO
- Treat critical/exploitable as P0 (immediate action)
- Verify patches actually resolve the vulnerability
- Export evidence for all remediation actions
- Re-scan after patching

## MUST NOT DO
- Never suppress advisories without documented risk acceptance
- Don't just bump versions — verify the fix
- Don't delay critical patches for convenience