Runs the loop from discovering a weakness to confirming it is fixed — scanning, triage, prioritization by real exploitability, remediation tracking, and patch policy. Use this to stand up or fix a vulnerability program, triage scanner output, decide what to fix first, set patch SLAs, handle a disclosure from an outside researcher, or report posture to leadership.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
Scanners are cheap and produce more findings than any team can fix. The whole discipline is deciding what actually matters and closing those.
A published severity score describes the vulnerability in the abstract. What matters is your instance of it. Rank by:
A queue sorted purely by severity guarantees the team spends its time on the wrong things while a medium-rated, internet-facing, actively exploited bug waits.
Every finding gets one of four outcomes, each recorded: fix, mitigate, accept (with an expiry and a named owner), or false positive (with the reason).
Nothing sits untriaged. An unreviewed backlog of thousands is the normal failure mode and it means the program is not running, whatever the dashboard says.
Tune the scanner. Persistent false positives train the team to dismiss everything, including the real finding.
Set SLAs by severity and exposure, publish them, and measure against them. Then measure the number that breach the SLA — that number, not the raw count, is the health of the program.
Have an emergency path for actively exploited vulnerabilities that bypasses the normal cycle, agreed in advance. Deciding how to ship an out-of-band patch during the incident wastes the hours that matter.
Most findings will be in third-party code. Keep dependencies current continuously rather than in large periodic jumps — a small regular upgrade is routine, a two-year jump is a project, and the project gets deferred.
Know what you actually ship. A dependency inventory you cannot produce means you cannot answer "are we affected" when the next widely-exploited library bug lands, and that question arrives with a clock attached.
Publish a way to report a vulnerability and an address that is monitored. Researchers who cannot find one disclose publicly instead.
Acknowledge quickly, give a realistic timeline, keep them updated, and credit them. Treating a good-faith reporter as an adversary is how a private report becomes a public one.
Leadership needs: what is exposed and unfixed past SLA, the trend, and what needs a decision. Not the count of findings, which mostly measures how much you scanned.
references/sources.md in this skill lists the outside authorities that settle the questions
here — what each one is authoritative for, and what you may do with it. Check them before
answering on anything they cover, and cite what you used. Most are free to read and not free
to reproduce; the use note on each is binding.
Infrastructure scanning: Tenable, Qualys, Rapid7 InsightVM, and similar. Code and dependencies: Snyk, Dependabot, GitHub Advanced Security, Semgrep, Trivy, and similar. Cloud posture: Wiz, Orca, Prisma Cloud, and similar.
Exploitability context — the CISA KEV catalog, EPSS scores — decides what you fix first. The scanner only decides what you know about.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and machine credentials, or diagnose why permissions have sprawled.
The English summary is being prepared. Showing the original description.
Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group inside each, tiering effort against account value, coordinating so the account experiences one campaign rather than several, and measuring account progression instead of leads. Use this to decide whether to run an account-based program, build one, or work out why an existing one produces activity and no pipeline.
The English summary is being prepared. Showing the original description.
Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account. Use this to design or fix signup and onboarding, diagnose why signups do not convert to active use, reduce time-to-value, or decide what a new user must accomplish first.
The English summary is being prepared. Showing the original description.
Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a script that runs in CI. Use this whenever the user wants to set up, expand, audit, or fix a multi-agent or subagent structure for a codebase; asks how to divide work between agents; wants agent charters, roles, or a surface map written; or is hitting agents that collide on the same files, review their own work, or drift from their remit. Also use when sizing a roster or deciding whether a new agent is justified.
The English summary is being prepared. Showing the original description.
Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire. Use this before deploying a model or AI feature, when defining evaluation criteria, when a model's behavior has drifted, when assessing AI risk or regulatory exposure, or when deciding whether an AI system is fit for a consequential decision.
The English summary is being prepared. Showing the original description.
Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit. Use this to analyze a market or industry, map competitors, evaluate a market-entry or build-versus-buy decision, produce a research brief, or assemble evidence for a decision. Also use when comparing options that need a structured, evidence-based verdict rather than an opinion.
The English summary is being prepared. Showing the original description.