Vulnerability Management Skill

Purpose

Systematic procedures for vulnerability discovery, remediation, and tracking in TypeScript/Node.js MCP server projects.

When to Use

• ✅ Analyzing Dependabot alerts
• ✅ Responding to GitHub Security Advisories
• ✅ Triaging CodeQL findings
• ✅ Prioritizing vulnerability remediation
• ✅ Managing SLA compliance for fixes

Severity Classification and SLAs

Vulnerability Lifecycle

1. Discovery

# Automated detection
npm audit                    # npm advisory check
npx knip                     # unused dependency detection
# + GitHub Dependabot alerts
# + CodeQL security scanning
# + GitHub secret scanning

2. Assessment

• CVSS score from NVD or GitHub Advisory
• Is vulnerable code path reachable?
• What data is exposed?
• Is a fix available?

3. Remediation

# Create remediation branch
git checkout -b security/CVE-2024-XXXXX

# Update dependency
npm update affected-package
# or
npm install affected-package@patched-version

# Verify
npm audit
npm test
npm run build

4. Verification

• ✅ npm audit clean
• ✅ All tests pass
• ✅ CodeQL scan clean
• ✅ No regressions
• ✅ Documentation updated

Compliance Mapping

ISMS Policy References

Core policies:

• Vulnerability Management — Primary policy: CVSS-based SLAs, lifecycle (discover → triage → fix → verify → close), responsible disclosure
• Secure Development Policy — CodeQL / SAST / DAST gates, pre-merge checks
• Open Source Policy — Supply-chain vulnerabilities, SBOM, dependency provenance
• Information Security Policy — Transparency of vulnerability posture

Supporting policies:

• Incident Response Plan — Critical / exploited vulnerabilities invoke IR
• Change Management — Remediation PRs follow standard review
• Privacy Policy — Breach notification if personal data exposure

Remediation SLAs (CVSS-based)