🔎 Vulnerability Scanning & Assessment

Overview

This skill enables Claude to assist with comprehensive vulnerability scanning and security assessment operations. It covers CVE detection, dependency auditing, configuration review, CVSS scoring, and automated vulnerability reporting.

---

Prerequisites

Required

• Python 3.8+
• requests, packaging, jinja2

Optional

• Nmap with NSE scripts — Network vulnerability scanning
• OpenVAS — Full vulnerability management
• Nuclei — Template-based vulnerability scanner
• Trivy — Container and dependency scanning

pip install requests packaging jinja2 pyyaml

---

Core Capabilities

1. Dependency Vulnerability Auditing

Claude can analyze project dependencies for known vulnerabilities:

When the user asks to audit dependencies:

1. Identify the project's package manager (pip, npm, go, maven, cargo, etc.)
2. Parse dependency files (requirements.txt, package.json, go.mod, pom.xml, Cargo.toml)
3. Extract exact versions for all direct and transitive dependencies
4. Query the OSV (Open Source Vulnerabilities) database and NVD for known CVEs
5. Map each vulnerability to its CVSS score and severity level
6. Check if patched versions are available
7. Generate a prioritized remediation report
8. Suggest minimum version upgrades to resolve vulnerabilities

Supported dependency files:

Language	Files
Python	requirements.txt, Pipfile.lock, pyproject.toml, setup.py
JavaScript	package.json, package-lock.json, yarn.lock
Go	go.mod, go.sum
Java	pom.xml, build.gradle
Rust	Cargo.toml, Cargo.lock
Ruby	Gemfile, Gemfile.lock
PHP	composer.json, composer.lock

2. Configuration Security Auditing

Claude can review server and application configurations for security issues:

When the user asks to audit configurations:

1. Parse the configuration file format (nginx, Apache, SSH, Docker, Kubernetes)
2. Check against CIS Benchmarks and security best practices
3. Identify dangerous defaults left unchanged
4. Flag overly permissive settings (wide-open CORS, directory listing, debug mode)
5. Check for missing security-hardening directives
6. Compare against known-good baseline configurations
7. Generate findings with severity, description, and remediation steps

Supported configurations:

• Web Servers: Nginx, Apache, IIS, Caddy
• SSH: OpenSSH sshd_config
• Databases: MySQL, PostgreSQL, MongoDB, Redis
• Container: Dockerfile, docker-compose.yml, Kubernetes manifests
• Cloud: AWS Security Groups, IAM Policies, S3 Bucket policies

3. Network Vulnerability Scanning

Integration with network scanning tools for host-level assessment:

When the user asks to scan for vulnerabilities:

1. Define scan scope (IP ranges, hostnames, ports)
2. Execute service detection scans
3. Run vulnerability detection scripts (Nmap NSE, custom checks)
4. Match discovered services against known vulnerable versions
5. Check for default credentials on common services
6. Test for critical misconfigurations (open relays, anonymous access)
7. Score and prioritize findings by CVSS

4. CVSS Scoring & Risk Assessment

Claude can calculate and explain CVSS scores:

When the user asks about CVSS:

1. Calculate CVSS v3.1 Base Score from attack vector metrics
2. Explain each metric's contribution to the score
3. Determine severity rating (None, Low, Medium, High, Critical)
4. Apply Temporal and Environmental adjustments if data is available
5. Generate risk matrices for multiple vulnerabilities
6. Prioritize remediation based on exploitability and impact

5. Vulnerability Report Generation

Generate professional vulnerability assessment reports:

When the user asks for a report:

1. Compile all findings with severity classification
2. Include executive summary for management audience
3. Provide technical details for each finding
4. Include proof-of-concept steps where applicable
5. List remediation recommendations prioritized by risk
6. Generate compliance mapping (PCI-DSS, SOC2, ISO 27001)
7. Export in multiple formats (JSON, HTML, Markdown, PDF-ready)

---

Usage Instructions

Example Prompts

> Audit the Python dependencies in this project for known CVEs
> Review this nginx configuration for security issues
> Calculate the CVSS v3.1 score for a remote code execution via unauthenticated API
> Generate a vulnerability assessment report from these scan results
> Check if any of these software versions have known exploits

---

Script Reference

dependency_auditor.py

python scripts/dependency_auditor.py --project-dir ./myapp --format json --output audit.json
python scripts/dependency_auditor.py --requirements requirements.txt --severity high,critical

config_auditor.py

python scripts/config_auditor.py --type nginx --config /etc/nginx/nginx.conf --output audit.json
python scripts/config_auditor.py --type sshd --config /etc/ssh/sshd_config

cvss_calculator.py

python scripts/cvss_calculator.py --vector "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

---

Integration Guide

Chaining with Other Skills

• ← Recon & OSINT (01): Receive discovered hosts and services for scanning
• → Exploit Development (03): Pass confirmed vulnerabilities for PoC development
• → Blue Team Defense (15): Generate remediation and hardening recommendations
• → CSOC Automation (11): Auto-generate tickets for discovered vulnerabilities

---

References

• NVD — National Vulnerability Database
• OSV — Open Source Vulnerabilities
• CVSS v3.1 Specification
• CIS Benchmarks
• OWASP Dependency-Check