How to use the Vulnerability Aging and SLA Tracking agent skill

What the skill makes the agent do

An agent skill is a folder of instructions and optional scripts that an AI agent loads when your request matches the skill's description. This one covers vulnerability aging and SLA tracking: measuring time-to-remediation against severity-based deadlines, flagging overdue items, triggering escalation steps and producing compliance metrics.

The SKILL.md file uses a standard framework of 14 days for critical, 30 days for high, 60 days for medium and 90 days for low vulnerabilities. It also includes adaptive modifiers, such as shorter deadlines for internet-facing assets or CISA KEV-listed vulnerabilities, and an escalation path that starts with a reminder at 50% of the SLA elapsed and reaches VP/CTO escalation at 120%.

• Design an SLA policy with deadlines by severity
• Calculate age, days overdue and percent of SLA elapsed for each vulnerability
• Produce an escalation list from open items
• Report KPIs such as mean time to remediate (MTTR), SLA compliance rate and overdue count

Install the skill

Download the ZIP file from this page and unzip it. You can install the skill in one of two ways.

For Claude Code, unzip it into ~/.claude/skills/ to make it available in all your projects, or into a project's .claude/skills/ folder to limit it to that project.

In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills

Set up what the skill needs

The skill needs Python 3 and pandas, because scripts/process.py depends on pandas. Your input must be a vulnerability export in CSV form that contains discovery_date, remediation_date and severity columns. Ticketing data or a reporting tool such as Splunk, Elastic, Power BI or Grafana is optional, and is useful for dashboards.

Without real discovery and remediation dates, the output will not mean anything.

• Python 3 and pandas
• A CSV export with discovery_date, remediation_date and severity columns
• Optional: ticketing or reporting platform such as Splunk, Elastic, Power BI or Grafana

Trigger the skill with natural requests

You do not need to name the skill. Ask in plain language about SLA policy, aging or remediation timelines, and the agent should load it. Be specific about your inputs and the output you want, such as a CSV path and whether you want a report or code.

Name the file and the outcome. The more context you give about your policy, the less the agent has to guess.

• "Set up a remediation SLA policy with 14 days for critical and 30 days for high, and write the calculation logic."
• "Here is vulnerabilities.csv. Calculate age and overdue status for each open finding and list what needs escalation."
• "Give me MTTR and SLA compliance rate by severity from this export for next month's security committee report."

Review the scripts and align the SLA values before use

The bundled scripts are scripts/agent.py and scripts/process.py. According to the skill's assessment, the scripts can process a CSV export and output aging reports and escalation lists. The skill's own notes say the scripts use hardcoded SLA values that differ between SKILL.md and scripts/agent.py, so you must check them against your own policy before you run anything.

The skill runs scripts. It does not use the network, according to its listing, so review the code yourself before running it on production data.

• Read scripts/agent.py and scripts/process.py and confirm the SLA values match your policy
• Test on a small sample CSV with known dates first
• Check that the escalation percentages match the escalation path you approved

Examples of useful output

Ask for the parts you need. The skill's template in assets/template.md includes a KPI summary, an aging distribution table by severity and an escalation summary table. Its references include standards such as NIST SP 800-40 Rev 4, CIS Controls v8.1 Control 7, PCI DSS v4.0 Req 6.3.3 and ISO 27001:2022 A.8.8.

Treat the reference tables as starting points. Some of them differ from the SKILL.md defaults, so pick one set of values and use it consistently.

• KPI summary: total open, MTTR, SLA compliance rate, overdue count, exception count
• Aging distribution by severity across age buckets
• Escalation list of open items with their level