Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Implementing Vulnerability Management with Greenbone · mukul975 | DecimalAI

Implementing Vulnerability Management With Greenbone

NewSkillScoreMaintained

implementing-vulnerability-management-with-greenbone

Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library to create scan targets, execute vulnerability scans, and parse scan reports via GMP protocol.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/implementing-vulnerability-management-with-greenbone/SKILL.md

decimalai skills pull implementing-vulnerability-management-with-greenbone --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/implementing-vulnerability-management-with-greenbone/SKILL.md https://app.decimal.ai/s/implementing-vulnerability-management-with-greenbone/SKILL.md

Raw file: /s/implementing-vulnerability-management-with-greenbone/SKILL.md ↗ · machine-readable summary at /s/implementing-vulnerability-management-with-greenbone.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

No — -100% lift+16% tokens0% turns0% of whole cases pass with skill (0/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-06	✗→✗	＝ Same ✗	—	—
case-05	✗→✗	＝ Same ✗	—	—
case-19	✗→✗	＝ Same ✗	—	—
case-07	✗→✗	＝ Same ✗	—	—
case-21	✗→✗	＝ Same ✗	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/implementing-vulnerability-management-with-greenbone/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Implementing Vulnerability Management with Greenbone

Overview

Greenbone Vulnerability Management (GVM) is the open-source framework behind OpenVAS, providing comprehensive vulnerability scanning with over 100,000 Network Vulnerability Tests (NVTs). The python-gvm library provides a Python API to interact with GVM through the Greenbone Management Protocol (GMP), enabling programmatic creation of scan targets, task management, scan execution, and report retrieval. This skill covers connecting to GVM via Unix socket or TLS, authenticating, creating scan configs and targets, launching scans, and parsing XML-based vulnerability reports to produce actionable findings.

When to Use

When deploying or configuring implementing vulnerability management with greenbone capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Greenbone Community Edition or Greenbone Enterprise Appliance installed
Python 3.9+ with python-gvm (pip install python-gvm)
GMP access credentials (username/password)
Network connectivity to GVM daemon (Unix socket or TCP/TLS)
Understanding of CVSS scoring and vulnerability classification

Steps

Install python-gvm: pip install python-gvm
Establish a GMP connection via UnixSocketConnection or TLSConnection
Authenticate with gmp.authenticate(username, password)
Create a target with gmp.create_target(name, hosts=[...], port_list_id=...)
Create a scan task with gmp.create_task(name, config_id, target_id, scanner_id)
Start the scan with gmp.start_task(task_id)
Monitor scan progress with gmp.get_task(task_id)
Retrieve results with gmp.get_report(report_id, report_format_id=...)
Parse the XML report for vulnerabilities, CVSS scores, and affected hosts
Generate a JSON summary report with severity distribution and remediation priorities

Expected Output

A JSON report containing total vulnerabilities found, severity breakdown (critical/high/medium/low), per-host findings with CVE references and CVSS scores, and scan metadata including duration and NVT feed version.

Illustrative Want to see what implementing-vulnerability-management-with-greenbone would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 10:01 UTC · 23 cases

Lift

-100%

0% vs 100%

Agent turns

1.0 vs 1.0

Tokens

+16%

1,792 vs 1,550.96

fail → fail · 23

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-06 Once a scan task identifier has been created in GVM via python-gvm, does the scan launch automatically, or is a specific trigger method required? State the exact call to execute the scan.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 To construct a new scan task programmatically in Greenbone Management Protocol, what dedicated API method binds together the task name, scan configuration, target configuration, and scanner engine?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 How does connection class selection in python-gvm differ when running an automation script locally on the Greenbone host versus running from a remote management server?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 In an automated scan pipeline, how does a Python script inspect the progress percentage and execution status of an active GVM scan task?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 A GVM scan report identifies an outdated OpenSSH package (CVE-2023-38408) on a target Ubuntu server at 192.168.1.50. How should an administrator patch this vulnerability on the target server?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When processing raw XML vulnerability reports returned by GVM, what specific vulnerability classification and identifier fields should be extracted from each finding element for security analysis?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Which Python PyPI package provides the standard, supported library interface for interacting with Greenbone Management Protocol daemons?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 How should vulnerability findings be organized in the structured JSON output summary to clearly map findings to infrastructure assets?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When requesting report output from `get_report` in python-gvm, what keyword parameter specifies the desired format identifier (such as XML format)?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 Write a shell command pipeline to update the Greenbone Community Feed (NVT, SCAP, CERT databases) on a Linux host running OpenVAS.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 A developer needs to connect to a remote Greenbone daemon over TCP port 9390 in Python. They plan to open a standard `ssl.SSLSocket` directly and push raw string commands. What class from the GVM library handles encrypted TCP network connections?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Instead of hardcoding a fixed `time.sleep(600)` delay after starting a scan, how should a Python script poll GVM to detect when a scan has completed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 Write a Python snippet to establish a connection to a local Greenbone daemon reading from socket file `/run/gvmd/gvmd.sock`. Someone suggested using `requests_unixsocket` to make HTTP calls over the socket. Which official Python class should be used for this socket connection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 In addition to host findings and severity counts, what scan runtime and feed version metadata should be captured in the final JSON summary report produced from a GVM scan?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 A Python script parses GVM scan results and builds a JSON summary. Rather than just reporting raw counts, what four severity classification tiers should be used to bucket vulnerability findings?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 When setting up host targets for a vulnerability scan programmatically, a developer assumes target IP addresses are specified directly inside task execution calls. What method should be called beforehand to define target host configurations?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 When constructing the top-level summary section of a GVM scan JSON report, what aggregate count metric must be calculated across all findings?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 After initializing a GMP client instance over a connection in Python, how must the script establish authenticated access before issuing scan management calls? Provide the method name and required arguments.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 After a GVM scan task finishes executing, what GMP API method fetches the completed vulnerability report data from the daemon?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When calling `create_target` in python-gvm to configure target IP addresses, what data structure type should be passed to the `hosts` argument?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When authenticating against a Greenbone daemon in Python using credentials, what should a script check or handle if the provided credentials are invalid?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 When calling `create_task` in python-gvm, a developer passes `name`, `config_id`, and `target_id`. What fourth key identifier parameter is required to specify which scan engine executes the task?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 How do you authenticate and trigger a scan task on a remote Tenable Nessus scanner using Python `requests` against its REST API?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of -100 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 100%
Pass rate with the skill: 0%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/28/2026, 10:01 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.