Stats
Actions
Tags
Help us improve
Share bugs, ideas, or general feedback.
From prodsec-skills
Enforces vulnerability management and patching for AI software dependencies with CVE triage, response timelines, and SBOM tracking.
npx claudepluginhub redhatproductsecurity/prodsec-skills --plugin prodsec-skillsHow this skill is triggered — by the user, by Claude, or both
Slash command
/prodsec-skills:vulnerability-managementThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
AI software projects MUST have a plan to quickly patch and release fixes for new CVEs discovered in their dependencies. Unpatched vulnerabilities in dependencies are one of the most common attack vectors.
Manages vulnerability lifecycle: tracks CVEs, scores with CVSS, prioritizes risks using EPSS/KEV, designs remediation workflows, patch management, and disclosure practices.
Audits third-party dependencies for known vulnerabilities, license issues, and supply chain risks. Guides SBOM generation, automated scanning, triage by CVSS score, and remediation.
Establish vulnerability management program to identify, prioritize, remediate, and track vulnerabilities across infrastructure.
Share bugs, ideas, or general feedback.
AI software projects MUST have a plan to quickly patch and release fixes for new CVEs discovered in their dependencies. Unpatched vulnerabilities in dependencies are one of the most common attack vectors.
New CVE disclosed
→ Automated alert (from SCA tool or advisory feed)
→ Triage: assess severity and exploitability in context
→ Prioritize: schedule fix based on severity and exposure
→ Patch: update dependency or apply workaround
→ Test: verify the fix does not break functionality
→ Release: publish patched version
→ Notify: inform users of the security update
| Severity | Target Remediation Window |
|---|---|
| Critical | 30 days from issue creation |
| Important | 60 days from issue creation |
| Moderate | 90 days from issue creation |
| Low | Best effort / no fixed SLA |
| Capability | Details |
|---|---|
| Dependency tracking | Know exactly which dependencies are in each release (SBOM) |
| CVE monitoring | Automated alerts for new CVEs affecting project dependencies |
| Rapid patching | Ability to quickly update dependencies and release patches |
| Security advisories | Publish security advisories for affected versions |
| Backporting | Support patching older, still-supported versions |