How to use the Vulnerability Scanning Workflow agent skill

What does this skill make the agent do?

The skill builds a structured vulnerability scanning workflow around scanners such as Nessus, Qualys and OpenVAS. It gives the agent code patterns for creating scans, exporting results, and ranking findings. The ranking combines CVSS severity, asset criticality, and whether a flaw appears on CISA's Known Exploited Vulnerabilities (KEV) catalog.

It also provides remediation SLA tiers by priority, a sample Splunk-style SIEM search that flags vulnerabilities being actively probed, and a bundled Python script (scripts/agent.py) that can run an Nmap-based scan and fetch the CISA catalog.

• Plan scan scope and schedules for infrastructure segments
• Prioritize results beyond raw CVSS scores
• Set remediation deadlines by priority tier (P1 to P5)
• Correlate scan data with IDS/IPS alerts in a SIEM
• Outline a remediation tracking dashboard

How do you install the skill?

Download the ZIP file from this page and unzip it. For a personal install, place the unzipped folder in ~/.claude/skills/. To scope the skill to one project, place it in that project's .claude/skills/ folder.

You can also upload the skill in the Claude apps. Open Settings, go to Capabilities, then choose Skills and upload the ZIP.

• Personal: ~/.claude/skills/
• Project only: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills

How do you trigger the skill with a request?

You do not need a special command. Describe the task in plain language and mention scanning, vulnerability management, prioritization, or remediation tracking. The agent loads the skill when the request matches its description.

The skill is meant for SOC teams establishing or improving recurring assessments, integrating scan results with SIEM alerting, and building remediation tracking. It is not meant for penetration testing or exploitation.

What example requests work well?

Good requests name your scanner, your asset groups, and the output you need. The agent can then draft policies, scripts or queries that you review before use.

• "Help me set up a weekly Nessus scan for our server and workstation subnets with credentialed checks."
• "Rank these Nessus CSV findings by CVSS, asset criticality and CISA KEV status."
• "Draft SLA deadlines for P1 to P5 remediation tiers for our business-critical servers."
• "Write a SIEM search that flags open critical CVEs that also show IDS alerts."

What do you need before running it?

The skill assumes you already have a scanner and the surrounding processes. The Python script needs Python 3 with the requests and python-nmap libraries, plus Nmap installed on the system. The scanner integrations need a Nessus, Qualys VMDR, or OpenVAS/Greenbone account with API keys. The full workflow also depends on an asset inventory with criticality classifications and SIEM access.

The reference file (references/api-reference.md) lists python-nmap at version 0.7.1 or later and requests at 2.28 or later, and shows the script's command-line options.

• Python 3 with requests and python-nmap
• Nmap installed on your system
• Scanner account and API keys (Nessus, Qualys VMDR, or OpenVAS/Greenbone)
• Asset inventory with criticality labels
• SIEM access for ingestion and correlation

What safety points should you know about?

This skill runs scripts and uses the network. The bundled script actively probes hosts, so only scan networks you own or have written authorization to scan. The skill's own guidance is that scanning identifies weaknesses while penetration testing validates exploitability, so do not use it for the latter.

The Nessus examples can disable TLS verification through an environment variable for self-signed certificates in lab environments. Keep verification on for production systems and review credentials and keys before running any code. Store scanner keys and service passwords outside the skill files.

• Scan only authorized ranges
• Review all scripts before running them
• Keep TLS verification enabled outside labs
• Do not put real secrets in the skill folder

What tips help the results be useful?

Keep your asset inventory current, because criticality drives both ranking and SLA tier. Refresh the CISA KEV data regularly so that the exploited-vulnerability flag stays accurate. Treat the SLA table as a starting template and adjust the deadlines to your own policy.

Check any generated query against your own index and sourcetype names before running it, since the examples use placeholder names such as index=vulnerability.

• Confirm asset criticality labels before ranking
• Re-fetch the KEV catalog on each run
• Adapt the SLA table to your policy
• Validate SIEM searches against your own data fields