How to use the Patch Tuesday Response Process agent skill

What is this skill and what does it make the agent do?

An agent skill is a folder of instructions and supporting files that an AI agent loads when a task matches the skill's description. This one gives the agent a structured playbook for Microsoft's monthly security updates, which Microsoft releases on the second Tuesday of each month.

The playbook covers the steps from reading the advisories through triage, testing, phased rollout across deployment rings, and validation scanning. It sets response deadlines by risk, for example 24-48 hours for actively exploited flaws, 3-5 days for critical remote code execution, and 14 days for high-severity issues.

• Templates for a monthly Patch Tuesday response report, including deployment status by ring and an exceptions and deferrals table
• Reference notes on the Microsoft MSRC API, the CISA Known Exploited Vulnerabilities list, and related industry standards
• Two Python scripts that pull Microsoft advisory data, cross-check the CISA known-exploited list and EPSS exploit-likelihood scores, and produce a prioritized deployment plan

How do you install the skill?

Download the ZIP file for the skill from this page. Unzip it into one of two locations, depending on how you want to use it.

For a personal setup, place the skill folder in your user skills directory at ~/.claude/skills/. For a single project, place it in the .claude/skills/ folder inside that project.

If you use the Claude apps instead of files on disk, open Settings, go to Capabilities, and upload the skill under Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

What do you need before you start?

The skill describes a process. It does not patch systems itself, and it cannot show the live patch status of your own machine. The scripts need several things to work fully.

The full workflow assumes you already run a vulnerability scanner such as Qualys, Rapid7 or Tenable, and a deployment tool such as WSUS or SCCM/MECM. Intune and third-party tools are also mentioned as deployment options.

• Python 3 with the requests and pandas libraries
• A Microsoft MSRC API key, which the scripts send in an api-key header
• Internet access to Microsoft, CISA and FIRST EPSS endpoints
• A vulnerability scanner and WSUS or SCCM for the full workflow
• A test environment that mirrors production, and a change management process

How do you trigger the skill with a natural request?

You do not need special syntax. Describe the job in plain words that match the skill's purpose: monthly patching, Patch Tuesday, or deciding which CVEs to fix first. The skill's description mentions building or improving a monthly patch management workflow and prioritizing which CVEs to remediate first, so requests phrased that way are the most likely to load it.

Name the products and tools you use, and say what output you want. The more specific you are, the more the agent can tailor the plan to your rings and deadlines.

• Plan this month's Patch Tuesday response for our Windows servers and workstations, using WSUS and SCCM rings.
• Which CVEs from this Patch Tuesday should we fix first? Cross-check CISA KEV and EPSS.
• Draft a Patch Tuesday triage checklist for the security operations team.
• Build a validation and compliance report template for last month's ring rollout.

What do the scripts do and what should you check first?

The scripts call external services. They pull Microsoft advisory data, check the CISA known-exploited list and EPSS scores, and produce a prioritized deployment plan. The skill's notes say the scripts run with stored scanner credentials when they scan targets, and they call external APIs.

Review the scripts before you run them, and test them outside production first. Do not run them with production credentials until someone on your team has read what they do and approved the access.

• The scripts make network calls to Microsoft, CISA and FIRST EPSS
• Scanning uses stored credentials, so limit those to a test scope at first
• Keep your MSRC API key out of shared files and logs

What does a typical Patch Tuesday cycle look like with this skill?

The skill lays out a timeline in days relative to Patch Tuesday, which Microsoft releases at 10 AM Pacific Time. Triage happens the same afternoon, zero-day fixes go out within the first two days, and the rest of the fleet moves through rings over about a month.

The rings run from emergency fixes for exploited flaws, to a pilot group of about 5-10% of the fleet, then production servers, workstations, and a final ring for stragglers that is enforced with a forced restart.

• Ring 0, emergency (0-48 hours): exploited CVEs only
• Ring 1, pilot (days 2-7): critical and high patches, with a 48-hour soak period
• Ring 2, production servers (days 7-14): off-hours maintenance windows
• Ring 3, workstations (days 14-21): security patches and quality updates
• Ring 4, stragglers (days 21-30): forced deployment with restart
• Validation (days 21-30): re-scan, compare pre- and post-patch results, and report compliance by ring