Security Vulnerability Assessment

---
name: security-vulnerability-assessment
description: Identify vulnerabilities across systems, code and configuration — OWASP Top 10, CVEs, dependencies, misconfigurations — ranked by CVSS and asset criticality. Use when the user asks which known vulnerabilities their systems and infrastructure have and what to patch first. Not for a package-only scan or pen test plan; see /security-dependency-scan or /security-pentest-plan.
metadata:
  argument-hint: "[project] [--skip-checks]"
  workflow: security
  phase: 1
  artifact: 01-identify.md
---

# Vulnerability Assessment

Identify and classify vulnerabilities across systems and code for "$ARGUMENTS". Map vulnerabilities to affected assets, prioritize by risk, and establish a remediation timeline.

**Arguments.** `$ARGUMENTS` may contain the project name and optional flags. Take the first token as `<project>` and treat `--skip-checks` as a flag; never include flags in file paths. All paths below use `<project>`. If `--skip-checks` is present, skip the prerequisite check and, **before writing any artifact**, append one line to `.singularskills/log.jsonl`: `{"ts":"<ISO timestamp>","skill":"security-vulnerability-assessment","workflow":"security","phase":1,"project":"<project>","event":"skipped","artifact":"01-identify.md","note":"<reason or \"none given\">"}`.

## Prerequisites

**Part of a workflow.** This skill is phase 1 (Identify) of the NIST CSF workflow (`security`); cross-domain workflows run it too. First check `.singularskills/log.jsonl` for an open run for this project: a `run-started` line with `"project":"<project>"` and no later `run-finished` line for the same `workflow` and `project`. If one exists, the conductor is running you: continue here. Otherwise, if the user asked to start, run, continue or resume a process or workflow rather than this one step, do not continue here: invoke the `workflow` skill with the workflow the user asked for, or `security` when they named none, followed by `<project>`; it runs this phase in order, asks before it writes and records the run. Otherwise continue here: a later phase runs on its own, behind its gate.

Run this skill's gate before writing: `sh <this skill's folder>/scripts/gate.sh <project> <project root>`, where `<project root>` is the folder that contains `.singularskills/` (use `.` when you are already there). If it exits non-zero, stop and tell the user what it printed, unless `--skip-checks` was given (see Arguments). On a refusal, before you stop, append this line to `.singularskills/log.jsonl` (create the folder and file if missing): `{"ts":"<ISO timestamp>","skill":"security-vulnerability-assessment","workflow":"security","phase":1,"project":"<project>","event":"refused","artifact":"01-identify.md","note":"<what the gate printed>"}`. Once the gate has passed, or under `--skip-checks` once you have appended the `skipped` line, append this line before you start work: `{"ts":"<ISO timestamp>","skill":"security-vulnerability-assessment","workflow":"security","phase":1,"project":"<project>","event":"started","artifact":"01-identify.md","note":""}`.

Read `.singularskills/security/<project>/00-govern.md`. If this file does not exist, tell the user:

> Phase 0 (Govern) has not been completed for "<project>". Run a Govern skill first (e.g., `/security-security-policy <project>`), or use `--skip-checks` to bypass.

## Process

1. **Define assessment scope:**
   - Identify systems, applications, and infrastructure in scope
   - Determine assessment type: network, application, code, configuration, or comprehensive
   - Define boundaries: production only, staging, or all environments
   - Establish rules of engagement and assessment window

2. **Identify vulnerability sources:**
   - **OWASP Top 10** — map application vulnerabilities against current OWASP Top 10 categories (injection, broken auth, sensitive data exposure, XXE, broken access control, misconfiguration, XSS, insecure deserialization, known vulnerable components, insufficient logging)
   - **CVE databases** — check known vulnerabilities in deployed software versions (NVD, vendor advisories)
   - **Dependency scans** — analyze third-party libraries and packages for known vulnerabilities (npm audit, pip safety, Dependabot, Snyk)
   - **Code analysis** — static analysis (SAST) findings, code review results, secrets in code
   - **Configuration review** — cloud misconfigurations, default credentials, overly permissive permissions, unencrypted storage

3. **Classify by CVSS score and exploitability:**
   - For each vulnerability, record:
     - **CVE/identifier** — CVE number or internal identifier
     - **CVSS base score** (0.0-10.0) and severity (None/Low/Medium/High/Critical)
     - **Exploitability** — is a public exploit available? Is it actively exploited in the wild?
     - **Attack vector** — network, adjacent, local, or physical
     - **Description** — what the vulnerability is and how it can be exploited

4. **Map to affected assets:**
   - Cross-reference each vulnerability with the asset inventory
   - Identify which systems, services, and data stores are affected
   - Note cascading effects: a vulnerability in a shared component affects all dependent assets
   - Highlight vulnerabilities affecting critical or customer-facing assets

5. **Prioritize by risk:**
   - Calculate effective risk: CVSS score x asset criticality modifier
     - Critical asset: 1.5x multiplier
     - High asset: 1.25x multiplier
     - Medium asset: 1.0x multiplier
     - Low asset: 0.75x multiplier
   - Factor in exploitability: actively exploited vulnerabilities get highest priority regardless of score
   - Group into remediation urgency: Immediate (0-48h), Urgent (1-2 weeks), Planned (30 days), Scheduled (90 days)

6. **Write the artifact** — append to `.singularskills/security/<project>/01-identify.md` under a `## Vulnerability Assessment` section. Create the file with a `# Identify — <project>` heading if it does not exist; if a `## Vulnerability Assessment` section already exists, replace only that section. The section contains:

   - **Assessment Scope** — systems assessed and methodology used
   - **Vulnerability Inventory** — all findings with CVE, CVSS, exploitability, and affected assets
   - **Risk Prioritization** — ranked list by effective risk score
   - **Remediation Timeline** — grouped by urgency with target resolution dates
   - **Trending Analysis** — patterns in vulnerability types indicating systemic issues

## Output

The vulnerability assessment appended to `.singularskills/security/<project>/01-identify.md`. Present a summary to the user highlighting:
- Total vulnerabilities found by severity level
- Most critical findings requiring immediate attention
- Systemic patterns across vulnerability types
- Recommended remediation timeline and priorities

**Record the run.** After you have written your section, append this line to `.singularskills/log.jsonl` (the `started` line of Prerequisites, with `"event":"finished"`): `{"ts":"<ISO timestamp>","skill":"security-vulnerability-assessment","workflow":"security","phase":1,"project":"<project>","event":"finished","artifact":"01-identify.md","note":""}`.

This artifact is shared by every skill of phase 1 (Identify). The frontmatter is written once, by whoever creates the file: if you create it, open it with the block below (`skill` is the phase title, `started` the time of that first write; `gate` is `passed` when the gate ran clean and `skipped` under `--skip-checks`); if it already exists, leave the block alone except to update `finished` and to set `gate` to the worst value among the sections (`skipped` over `passed`).

```yaml
---
skill: Identify
workflow: security
phase: 1
project: <project>
started: <ISO timestamp>
finished: <ISO timestamp>
agent: <the agent you run in, or "unknown">
gate: <passed|skipped>
---
```

Open your `## Vulnerability Assessment` section with one italic line, `*<skill name> · <ISO timestamp> · gate: <passed|skipped>*` (your skill name is `security-vulnerability-assessment`).

End your section with `### Decisions` and `### Open questions` (one level under your `## Vulnerability Assessment` heading, so the section stays one block), in this shape:

```markdown
### Decisions
- <what was chosen> — <why> — <what was rejected>

### Open questions
- <what the next phase or a reviewer must settle>
```

End the artifact with this paragraph, verbatim:

> **Not a penetration test or audit.** This artifact is generated analysis; validate findings against the live system and have material controls reviewed by a qualified security professional.