How to use the Vulnerability Exception Tracker agent skill

What the skill makes the agent do

An agent skill is a folder of instructions and example files that an AI agent loads when your request matches the skill's description. This skill covers the paperwork side of vulnerability management: exception requests, approvals, compensating controls and expiration. It does not scan systems or fix vulnerabilities.

The skill's description says it is for standing up a governance process for risk acceptance and exception approvals that supports PCI DSS, SOC 2 or NIST CSF compliance.

• A request form with CVE ID, finding ID, asset, severity, CVSS score, category, justification and requested expiration
• Approval steps that depend on severity
• A required write-up of compensating controls covering detection, prevention, response and monitoring
• A daily expiration check and a monthly exception report, produced by included scripts

How to install the skill

Download the skill ZIP from this page and unzip it. You can install it in one of two ways. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder.

You can also upload the skill in the Claude apps by going to Settings, then Capabilities, then Skills, and adding the ZIP there.

• Personal: unzip into ~/.claude/skills/
• Project only: unzip into .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How to trigger the skill with natural requests

You do not need a special command. The agent loads the skill when your request fits its description, so describe the governance task in plain language. Name the goal (an exception process, risk acceptance, compensating controls, or an audit framework) so the agent can match it.

Good requests state what you are building and which framework it must support. Vague requests such as fix my vulnerabilities will not match, because the skill does not do remediation.

• Help me set up a risk acceptance process for vulnerabilities that miss SLA deadlines, for a PCI DSS audit
• Design an exception request form with compensating controls fields for a SOC 2 review
• Show me a database schema for tracking vulnerability exceptions and their automatic expiry
• Write a daily check that flags expired vulnerability exceptions

What the skill's approval and expiry rules look like

The skill defines exception categories (remediation delay, no fix available, business critical, false positive, compensating control), each with a maximum duration and approver level. The request schema and database schema include fields for status, approvers, approval time, expiry and review notes, and an audit log table records each action.

The source gives two different sets of duration limits, and they do not match. The category table in SKILL.md lists 30 days for remediation delay, 90 for no fix available, 60 for business critical, permanent for false positives and 180 for compensating controls. The API reference lists maximum days by severity instead: 30 for Critical, 90 for High, 180 for Medium and 365 for Low. Pick one policy deliberately and align the code and documents to it before use.

• Approval chain by severity in the API reference: Critical goes to Security Lead, CISO and Risk Committee; High to Security Lead and CISO; Medium and Low to Security Lead
• Exception states include draft, pending approval, approved, rejected, expired and revoked

Document compensating controls for each exception

A compensating control is an extra safeguard, such as a firewall rule or monitoring, that reduces risk when the vulnerability stays open. The skill asks that each exception address four areas, and the form template repeats them as fields.

Each answer should name a specific control, not a general intention. The example request form in the skill cites a WAF rule, network segmentation and an alert in a monitoring tool.

• Detection: how exploitation attempts will be noticed
• Prevention: what barriers lower the chance of exploitation
• Response: which incident response procedure applies to this vulnerability
• Monitoring: what ongoing checks show the controls still work

Run the expiration check and monthly report

The included script scripts/process.py has two options shown in the skill. Run the expiration check daily, for example from a scheduler such as cron. Run the report monthly. The skill says the scripts create a local SQLite database, so you can test without a server.

Before relying on these commands, check the code. The skill notes that the Flask approve and reject routes do not yet update a database, and that the maximum-duration check is incomplete.

Requirements and safety notes

You need Python 3.9 or later with the flask, sqlalchemy, requests and jinja2 packages, plus PostgreSQL or SQLite. Email or Slack notifications and a vulnerability platform API such as DefectDojo, Qualys or Tenable are optional.

The skill runs scripts and uses the network. Read scripts/agent.py and scripts/process.py before running them, and check what any network calls send. The skill is not an audited product and does not replace legal or auditor sign-off.

• Runs scripts: yes
• Uses network: yes
• Treat the code as a sketch: validate, test and have a compliance review before production use