Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.
Before & after
Same prompt, same agent — the only difference is the skill.
CVE vulnerabilities are serious and you'll want to patch quickly. You'd need to identify what you're using, update to a safe version, and make sure you test before deploying. Depending on the severity, you might also want to add some compensating controls. What dependency is affected?
CVE REMEDIATION + HARDENING PLAN: IMMEDIATE (Today): ☐ Dependency: Log4j 2.14.1 → CVE-2021-44228 (RCE) ☐ Current version: 2.14.1 (VULNERABLE) ☐ Safe versions: 2.16.0+ or 2.17.0+ (with fixes) ☐ Action: Bump to 2.17.1 + test in staging WHILE PATCHING (2-4 hours, parallel): ☐ Add WAF rule: Block JNDI strings in HTTP headers ☐ Block outbound LDAP on prod (remove if unused) ☐ Rotate all service credentials (potential compromise) ☐ Review CloudTrail logs for suspicious JNDI lookups (last 48h) COMPLIANCE CHECKLIST: SOC 2 Type II: ☐ Vulnerability severity tracked + remediation SLA (Critical = 24h) ☐ Patch deployed to staging → validated → prod deployment logged ☐ Change approval documented (emergency change log) PCI-DSS v3.2.1: ☐ No delay allowed; Critical CVE requires same-day patch assessment ☐ Anti-malware signature updated (Log4j JNDI known signatures) HIPAA (if applicable): ☐ Risk analysis documented (impact to PHI systems?) ☐ Remediation timeline approved FULL HARDENING (Next 48h): • SCA scan: Run toolchain on all dependencies (find 4+ other outdated packages) • Secrets scan: Ensure no embedded creds in updated code • Staging deployment: Run full regression (2-3h) • Prod rollout: Blue-green deploy, monitor error rate 30m post-deploy • Communication: Notify 3 customers of patch + zero-impact claim WEEK 2 FOLLOWUP: → Automate dependency updates (weekly scanning) → Enforce max 30-day patch SLA in CI/CD
About this skill
Your scanner says critical, but you still need to know whether production is exposed, what to fix first, and how to prove the fix worked. This skill turns security alerts and audit requests into scoped findings, practical remediation, and explicit verification steps without treating scanner output as proof.
What it does
- Traces dependency alerts from affected versions to deployed artifacts, reachable code, and attacker-controlled inputs.
- Reviews SAST and DAST findings for exploit prerequisites, false positives, and missing evidence.
- Builds patch plans with compatibility checks, temporary mitigations, rollout gates, and safe recovery options.
- Reviews authentication, authorization, secrets handling, and infrastructure boundaries for concrete failure paths.
- Designs CI security gates that distinguish new exposure from accepted backlog and require expiring exceptions.
- Maps compliance requests to applicable controls, supporting evidence, and unresolved gaps.
What you get
An appropriately sized security assessment or remediation plan with prioritized findings, evidence, owners, and acceptance checks. For implementation requests, you also get focused code or configuration changes when access permits, with verification status stated accurately.
Best for
Engineering teams handling dependency alerts, preparing releases, hardening applications, answering security questionnaires, or collecting evidence for SOC 2, PCI DSS, HIPAA, and GDPR obligations.
SKILL.md preview
---
name: application-security-triage-and-remediation
description: Triage application, dependency, and infrastructure security findings by tracing attacker input, deployment exposure, and exploit prerequisites; produce safe fixes, verification steps, and control evidence. Use when the user says "is this CVE urgent?", "our scanner keeps reporting the same vulnerability", "review this release for security", "help me harden authentication", "we leaked a secret", "add security checks to CI", or "what evidence do we need for this audit?".
---
# Application Security Triage and Remediation
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
LLM App and Agent Security Assessment
Threat-model an LLM app or agent: map injection paths, rate tool blast radius, and get architectural fixes plus canary tests.