New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Building Vulnerability Exception Tracking System

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA…

Apache-2.0Auto-check passedLegal & Compliance

Install Building Vulnerability Exception Tracking System

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-vulnerability-exception-tracking-system -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills building-vulnerability-exception-tracking-system --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/building-vulnerability-exception-tracking-system .claude/skills/building-vulnerability-exception-tracking-system && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
building-vulnerability-exception-tracking-system
GitHub stars
34k
Token cost
~1.7k tokens
SKILL.md length
276 words
Files
8 (incl. scripts, references, assets)
Skills in repo
637
Repo updated
First seen
Licence
Apache-2.0

At a glance

Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA…

  • Works in 4 steps: Detection: How will exploitation… → Prevention: What barriers reduce… → Response: What incident response… → …
  • Standing up a governance process for risk acceptance and exception approvals to support PCI DSS
  • SKILL.md covers Overview, When to Use, Prerequisites and Exception Request Workflow, plus 4 more sections
  • Runs Python scripts from its folder; calls python3

What it does

Building Vulnerability Exception Tracking System is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.

Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Legal & Compliance, covering Healthcare and finance regulation and SOC 2 and security compliance. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Standing up a governance process for risk acceptance and exception approvals to support PCI DSS
  • NIST CSF compliance

Example prompts

  • “/building-vulnerability-exception-tracking-system”

Requirements

  • Python 3

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Detection: How will exploitation attempts be detected?
  2. Prevention: What barriers reduce exploitation likelihood?
  3. Response: What incident response procedures are in place?
  4. Monitoring: What continuous monitoring ensures controls remain effective?

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • csrc.nist.gov
    • docs-prv.pcisecuritystandards.org
    • cisecurity.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Building Vulnerability Exception Tracking System loads about 1.7k tokens when it runs, and up to ~3.2k if it reads all its reference files. Until then it costs about 100 tokens; SKILL.md has 276 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~100
When it runs · the whole SKILL.md, loaded when a task matches
~1.7k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 276 words, ~1,734 tokens.

Download SKILL.mdSave it as .claude/skills/building-vulnerability-exception-tracking-system/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
building-vulnerability-exception-tracking-system
description
Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.
domain
cybersecurity
subdomain
vulnerability-management
tags
vulnerability-exception, risk-acceptance, compensating-controls, exception-tracking, vulnerability-management, governance
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
ID.RA-01, ID.RA-02, ID.IM-02, ID.RA-06
mitre_attack
T1190, T1068

Building Vulnerability Exception Tracking System

Overview

A vulnerability exception tracking system manages cases where vulnerabilities cannot be remediated within SLA timelines. It provides structured workflows for requesting exceptions, documenting compensating controls, obtaining risk acceptance approvals, and automatically expiring exceptions when their validity period ends. This ensures organizations maintain visibility into accepted risks while complying with frameworks like PCI DSS, SOC 2, and NIST CSF.

When to Use

  • When deploying or configuring building vulnerability exception tracking system capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Python 3.9+ with flask, sqlalchemy, requests, jinja2
  • PostgreSQL or SQLite database
  • Email/Slack integration for approval notifications
  • Vulnerability management platform API (DefectDojo, Qualys, Tenable)

Exception Request Workflow

Exception Categories
CategoryDescriptionMax DurationApprover Level
Remediation DelayPatch available but deployment blocked30 daysTeam Lead + Security
No Fix AvailableVendor has not released a patch90 daysSecurity Director
Business CriticalSystem cannot be patched without outage60 daysVP Engineering + CISO
False PositiveFinding is not a real vulnerabilityPermanentSecurity Analyst
Compensating ControlAlternative mitigation in place180 daysSecurity Architect
Required Fields for Exception Request
python
exception_schema = {
    "cve_id": "CVE-2024-XXXX",
    "finding_id": "unique-finding-reference",
    "asset_hostname": "prod-db-01.corp.local",
    "severity": "high",
    "cvss_score": 8.1,
    "category": "remediation_delay",
    "justification": "Database upgrade required before patch can be applied",
    "compensating_controls": [
        "WAF rule blocking exploit pattern deployed",
        "Network segmentation restricting access to trusted VLANs only",
        "Enhanced monitoring via Splunk alert for exploitation indicators"
    ],
    "requested_expiration": "2024-06-15",
    "requestor_email": "dbadmin@company.com",
    "approver_emails": ["security-lead@company.com", "ciso@company.com"],
    "risk_rating": "medium",
}

Database Schema

sql
CREATE TABLE vulnerability_exceptions (
    id SERIAL PRIMARY KEY,
    cve_id VARCHAR(20) NOT NULL,
    finding_id VARCHAR(100) NOT NULL,
    asset_hostname VARCHAR(255),
    severity VARCHAR(20),
    cvss_score DECIMAL(3,1),
    category VARCHAR(50) NOT NULL,
    justification TEXT NOT NULL,
    compensating_controls TEXT,
    status VARCHAR(20) DEFAULT 'pending',
    requested_by VARCHAR(255) NOT NULL,
    approved_by VARCHAR(255),
    requested_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    approved_at TIMESTAMP,
    expires_at TIMESTAMP NOT NULL,
    expired BOOLEAN DEFAULT FALSE,
    risk_rating VARCHAR(20),
    review_notes TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE exception_audit_log (
    id SERIAL PRIMARY KEY,
    exception_id INTEGER REFERENCES vulnerability_exceptions(id),
    action VARCHAR(50) NOT NULL,
    actor VARCHAR(255) NOT NULL,
    details TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE INDEX idx_exception_status ON vulnerability_exceptions(status);
CREATE INDEX idx_exception_expires ON vulnerability_exceptions(expires_at);
CREATE INDEX idx_exception_cve ON vulnerability_exceptions(cve_id);

Implementation

Exception Request API
python
from flask import Flask, request, jsonify
from datetime import datetime, timezone
import json

app = Flask(__name__)

@app.route("/api/exceptions", methods=["POST"])
def create_exception():
    data = request.json
    required = ["cve_id", "finding_id", "category", "justification", "expires_at", "requestor_email"]
    for field in required:
        if field not in data:
            return jsonify({"error": f"Missing required field: {field}"}), 400

    # Validate expiration does not exceed category maximum
    max_days = {"remediation_delay": 30, "no_fix": 90, "business_critical": 60,
                "false_positive": 365, "compensating_control": 180}
    # Insert into database and notify approvers
    return jsonify({"status": "pending", "id": "exc-12345"})

@app.route("/api/exceptions/<exc_id>/approve", methods=["POST"])
def approve_exception(exc_id):
    approver = request.json.get("approver_email")
    notes = request.json.get("notes", "")
    # Update status to approved, record approver and timestamp
    return jsonify({"status": "approved"})

@app.route("/api/exceptions/<exc_id>/reject", methods=["POST"])
def reject_exception(exc_id):
    reviewer = request.json.get("reviewer_email")
    reason = request.json.get("reason")
    # Update status to rejected, record reviewer and reason
    return jsonify({"status": "rejected"})
Expiration Checker (Daily Cron)
bash
# Check for expired exceptions daily
python3 scripts/process.py --check-expirations

# Generate monthly exception report
python3 scripts/process.py --report --output exception_report.json

Compensating Controls Documentation

For each exception, compensating controls must address:

  1. Detection: How will exploitation attempts be detected?
  2. Prevention: What barriers reduce exploitation likelihood?
  3. Response: What incident response procedures are in place?
  4. Monitoring: What continuous monitoring ensures controls remain effective?

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/building-vulnerability-exception-tracking-system of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Building Vulnerability Exception Tracking System next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Building Vulnerability Exception Tracking System compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Building Vulnerability Exception Tracking System this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.7kAutomated safety check: PassApache-2.0
Grc Knowledgemlunato47/claude-grc-plugin183—~6.1kAutomated safety check: PassMIT
Audit Reportharness/harness-skills115—~1.3kAutomated safety check: PassApache-2.0
Security Compliancesangrokjung/claude-forge8502 repos~7.2kAutomated safety check: PassMIT
Ciso Advisoralirezarezvani/claude-skills28k1 repos~1.8kAutomated safety check: PassMIT
ComplianceRightNow-AI/openfang18k—~921Automated safety check: PassApache-2.0

Similar skills

  • Grc Knowledge

    mlunato47/claude-grc-plugin

    Senior GRC analyst expertise across 18 compliance frameworks — NIST 800-53, FedRAMP (Rev5 + 20x/CR26, KSIs, VDR/VER, Certification Classes A–D), DoD/DoW Impact Levels (IL2–IL6, DISA Cloud SRG), ITAR…

    183 GitHub stars~6.1k tokensUpdated 2 days ago
    Legal & ComplianceAuto-check passed

  • Audit Report

    harness/harness-skills

    Generate audit reports and compliance trails using Harness audit trail data via MCP v2 tools.

    115 GitHub stars~1.3k tokensUpdated 2 days ago
    Legal & ComplianceAuto-check passed

  • Security Compliance

    sangrokjung/claude-forge

    Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and…

    850 GitHub starsUsed in 2 repos~7.2k tokens
    Legal & ComplianceAuto-check passed

  • Ciso Advisor

    alirezarezvani/claude-skills

    Security leadership for growth-stage companies. An agent skill from alirezarezvani/claude-skills.

    28k GitHub starsUsed in 1 repo~1.8k tokens
    Legal & ComplianceAuto-check passed

  • Compliance

    RightNow-AI/openfang

    Compliance expert for SOC 2, GDPR, HIPAA, PCI-DSS, and security frameworks

    18k GitHub stars~921 tokensUpdated 3 mo ago
    Legal & ComplianceAuto-check passed

  • Eks Security

    aws-samples/appmod-blueprints

    Official

    A skill your agent uses whenever someone needs security or compliance guidance for Amazon EKS — phrased as "CIS Benchmark for EKS", "HIPAA / PCI-DSS / FedRAMP / SOC 2 / GDPR on EKS", "harden my EKS…

    113 GitHub stars~4.7k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 637 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Building Vulnerability Exception Tracking System

What does Building Vulnerability Exception Tracking System do?

Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA…. Building Vulnerability Exception Tracking System is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines.

When should I use Building Vulnerability Exception Tracking System?

Building Vulnerability Exception Tracking System fits situations like: standing up a governance process for risk acceptance and exception approvals to support PCI DSS; NIST CSF compliance.

How do I install Building Vulnerability Exception Tracking System in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-vulnerability-exception-tracking-system -a claude-code`. Or copy the skill folder (skills/building-vulnerability-exception-tracking-system in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/building-vulnerability-exception-tracking-system in your project. Claude Code loads it when a task matches its description.

How do I install Building Vulnerability Exception Tracking System in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-vulnerability-exception-tracking-system -a codex`. Or copy the skill folder (skills/building-vulnerability-exception-tracking-system in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/building-vulnerability-exception-tracking-system in your project. Codex loads it when a task matches its description.

Can I use Building Vulnerability Exception Tracking System in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-vulnerability-exception-tracking-system -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/building-vulnerability-exception-tracking-system, .gemini/skills/building-vulnerability-exception-tracking-system, .github/skills/building-vulnerability-exception-tracking-system and .opencode/skills/building-vulnerability-exception-tracking-system in your project.

What does Building Vulnerability Exception Tracking System need to run?

Going by SKILL.md and its folder, Building Vulnerability Exception Tracking System needs Python for the scripts in its folder and the command-line tools its instructions call (python3). Our summary lists: Python 3.

Does Building Vulnerability Exception Tracking System access the network?

SKILL.md names 3 domains. As links in the text: csrc.nist.gov, docs-prv.pcisecuritystandards.org and cisecurity.org. This is read from the text; nothing was executed.

Is Building Vulnerability Exception Tracking System safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Building Vulnerability Exception Tracking System use?

Building Vulnerability Exception Tracking System is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Building Vulnerability Exception Tracking System use?

About 1.7k tokens (SKILL.md is roughly 6.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.4k tokens, read only when the agent opens those files.

What are the alternatives to Building Vulnerability Exception Tracking System?

Skills that share tags, products or a category with Building Vulnerability Exception Tracking System: Grc Knowledge (mlunato47/claude-grc-plugin, 183 stars), Audit Report (harness/harness-skills, 115 stars), Security Compliance (sangrokjung/claude-forge, 850 stars) and Ciso Advisor (alirezarezvani/claude-skills, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Building Vulnerability Exception Tracking System?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,922 GitHub stars. The repository holds 637 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.