Imported from aibot88/sec_skill_store (skills/claudskills/security-vulnerability/SKILL.md). Install upstream with npx skills add aibot88/sec_skill_store --skill security-vulnerability. Copyright stays with the author.

Security Vulnerability Management

إدارة الثغرات الأمنية

Architecture

┌──────────────────────────────────────────────────────────┐
│                  Security Operations Center               │
│                                                          │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌─────────┐ │
│  │ Vuln     │  │ SAST     │  │ DAST     │  │ Depend  │ │
│  │ Scanner  │  │ Code     │  │ Runtime  │  │ Check   │ │
│  │ (Infra)  │  │ Analysis │  │ Scan     │  │ (SCA)   │ │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘  └────┬────┘ │
│       └──────────────┼──────────────┼─────────────┘      │
│                      ▼                                    │
│              ┌──────────────┐                             │
│              │  Aggregator  │                             │
│              │  & Dedup     │                             │
│              └──────┬───────┘                             │
│                     ▼                                     │
│              ┌──────────────┐      ┌──────────────┐      │
│              │ Risk Scoring │─────►│ Alert Engine │      │
│              │ & Prioritize │      │ & Workflow   │      │
│              └──────────────┘      └──────────────┘      │
└──────────────────────────────────────────────────────────┘

Domain Model

// === الثغرة الأمنية ===
public class Vulnerability : BaseAuditableEntity
{
    public int Id { get; set; }
    public string VulnId { get; set; } = string.Empty;          // VULN-2024-00001
    public string Title { get; set; } = string.Empty;
    public string Description { get; set; } = string.Empty;
    
    // Classification
    public VulnerabilityType Type { get; set; }
    public VulnerabilityCategory Category { get; set; }
    public string? CveId { get; set; }                           // CVE-2024-XXXXX
    public string? CweId { get; set; }                           // CWE-79 (XSS)
    public string? OwaspCategory { get; set; }                   // A01:2021
    
    // Severity (CVSS v3.1)
    public decimal CvssScore { get; set; }                       // 0.0 - 10.0
    public CvssSeverity Severity { get; set; }
    public string? CvssVector { get; set; }                      // CVSS:3.1/AV:N/AC:L/...
    
    // Risk Assessment
    public ExploitabilityLevel Exploitability { get; set; }
    public bool IsExploitedInWild { get; set; }
    public bool HasPublicExploit { get; set; }
    public BusinessImpact BusinessImpact { get; set; }
    public int RiskScore { get; set; }                           // Custom: CVSS × Impact
    
    // Affected Asset
    public int AssetId { get; set; }
    public string AssetName { get; set; } = string.Empty;
    public AssetType AssetType { get; set; }
    public string? AffectedComponent { get; set; }
    public string? AffectedVersion { get; set; }
    
    // Discovery
    public DiscoverySource Source { get; set; }
    public DateTime DiscoveredAt { get; set; }
    public int? DiscoveredByUserId { get; set; }
    public string? ScanToolName { get; set; }
    
    // Remediation
    public VulnStatus Status { get; set; }
    public string? RemediationPlan { get; set; }
    public string? Workaround { get; set; }
    public int? AssignedToId { get; set; }
    public DateTime? RemediationDueDate { get; set; }
    public DateTime? RemediatedAt { get; set; }
    public DateTime? VerifiedAt { get; set; }
    public int? VerifiedByUserId { get; set; }
    
    // SLA tracking
    public int SlaHours { get; set; }                            // Based on severity
    public bool IsSlaBreached { get; set; }
    
    public List<VulnerabilityNote> Notes { get; set; } = new();
    public List<VulnerabilityAttachment> Attachments { get; set; } = new();
}

public enum CvssSeverity
{
    None,           // 0.0
    Low,            // 0.1-3.9
    Medium,         // 4.0-6.9
    High,           // 7.0-8.9
    Critical        // 9.0-10.0
}

public enum VulnerabilityType
{
    Infrastructure,     // بنية تحتية
    Application,        // تطبيقات
    Configuration,      // إعدادات
    CodeLevel,          // مستوى الكود
    Dependency,         // مكتبات خارجية
    Network,            // شبكة
    CloudMisconfig,     // إعدادات سحابية
    Authentication,     // مصادقة
    Encryption          // تشفير
}

public enum VulnerabilityCategory
{
    // OWASP Top 10 (2021)
    BrokenAccessControl,        // A01 - كسر التحكم بالوصول
    CryptographicFailures,      // A02 - فشل التشفير
    Injection,                  // A03 - حقن
    InsecureDesign,             // A04 - تصميم غير آمن
    SecurityMisconfiguration,   // A05 - إعدادات أمنية خاطئة
    VulnerableComponents,       // A06 - مكونات ضعيفة
    AuthenticationFailures,     // A07 - فشل المصادقة
    IntegrityFailures,          // A08 - فشل سلامة البيانات
    LoggingFailures,            // A09 - فشل التسجيل والمراقبة
    SSRF,                       // A10 - تزوير الطلبات
    Other
}

public enum DiscoverySource
{
    AutomatedScan,          // فحص تلقائي
    PenetrationTest,        // اختبار اختراق
    BugBounty,              // مكافآت الثغرات
    CodeReview,             // مراجعة الكود
    IncidentResponse,       // استجابة لحادث
    VendorAdvisory,         // تنبيه من المورد
    ThreatIntelligence,     // استخبارات تهديد
    InternalAudit,          // تدقيق داخلي
    UserReport              // بلاغ مستخدم
}

// === الحادث الأمني ===
public class SecurityIncident : BaseAuditableEntity
{
    public int Id { get; set; }
    public string IncidentNumber { get; set; } = string.Empty;
    public string Title { get; set; } = string.Empty;
    public string Description { get; set; } = string.Empty;
    public IncidentSeverity Severity { get; set; }
    public IncidentType Type { get; set; }
    public IncidentStatus Status { get; set; }
    
    // Impact
    public string? AffectedSystems { get; set; }
    public int? AffectedUsersCount { get; set; }
    public bool DataBreached { get; set; }
    public string? DataBreachDetails { get; set; }
    
    // Timeline
    public DateTime DetectedAt { get; set; }
    public DateTime? ContainedAt { get; set; }
    public DateTime? EradicatedAt { get; set; }
    public DateTime? RecoveredAt { get; set; }
    public DateTime? LessonsLearnedAt { get; set; }
    
    // Assignment
    public int? IncidentCommanderId { get; set; }
    public List<int> ResponseTeamIds { get; set; } = new();
    
    public List<IncidentTimeline> Timeline { get; set; } = new();
    public List<int> RelatedVulnerabilityIds { get; set; } = new();
}

public enum IncidentType
{
    Malware,                // برمجيات خبيثة
    Phishing,               // تصيد احتيالي
    Ransomware,             // فدية
    DataBreach,             // تسريب بيانات
    DDoS,                   // حجب خدمة
    UnauthorizedAccess,     // وصول غير مصرح
    InsiderThreat,          // تهديد داخلي
    AccountCompromise,      // اختراق حساب
    WebDefacement,          // تشويه موقع
    DataLoss                // فقدان بيانات
}

// === أصل أمني ===
public class SecurityAsset
{
    public int Id { get; set; }
    public string Name { get; set; } = string.Empty;
    public SecurityAssetType Type { get; set; }
    public string? IpAddress { get; set; }
    public string? Hostname { get; set; }
    public string? OperatingSystem { get; set; }
    public string? Version { get; set; }
    public CriticalityLevel Criticality { get; set; }
    public int DepartmentId { get; set; }
    public DateTime? LastScanDate { get; set; }
    public int OpenVulnerabilities { get; set; }
}

Vulnerability Scanner Integration

public interface IVulnerabilityScanner
{
    Task<ScanResult> ScanAsync(ScanRequest request);
    Task<List<Vulnerability>> ParseResultsAsync(ScanResult result);
}

// === SAST - Static Application Security Testing ===
public class SastScanner
{
    public async Task<List<CodeVulnerability>> ScanCodeAsync(string repositoryPath)
    {
        var vulnerabilities = new List<CodeVulnerability>();
        
        // Pattern-based detection
        var patterns = new Dictionary<string, SecurityPattern>
        {
            ["SQL_INJECTION"] = new()
            {
                Regex = @"(string\.Format|[""'].*\+.*[""']).*(@"".*SELECT|INSERT|UPDATE|DELETE)",
                CweId = "CWE-89",
                Severity = CvssSeverity.Critical,
                Description = "SQL Injection المحتمل - استخدم parameterized queries"
            },
            ["XSS"] = new()
            {
                Regex = @"@Html\.Raw\(|innerHTML\s*=|dangerouslySetInnerHTML",
                CweId = "CWE-79",
                Severity = CvssSeverity.High,
                Description = "XSS المحتمل - استخدم HTML encoding"
            },
            ["HARDCODED_SECRET"] = new()
            {
                Regex = @"(password|secret|apikey|api_key|token)\s*=\s*[""'][^""']+[""']",
                CweId = "CWE-798",
                Severity = CvssSeverity.High,
                Description = "بيانات سرية مكتوبة في الكود - استخدم Key Vault"
            },
            ["INSECURE_CRYPTO"] = new()
            {
                Regex = @"(MD5|SHA1|DES)\.",
                CweId = "CWE-327",
                Severity = CvssSeverity.Medium,
                Description = "خوارزمية تشفير ضعيفة - استخدم SHA256+ أو AES"
            },
            ["PATH_TRAVERSAL"] = new()
            {
                Regex = @"Path\.Combine\(.*Request\.|\.\.\/|\.\.\\",
                CweId = "CWE-22",
                Severity = CvssSeverity.High,
                Description = "Path Traversal المحتمل - تحقق من المسارات"
            }
        };
        
        // Scan all code files
        var codeFiles = Directory.GetFiles(repositoryPath, "*.*", SearchOption.AllDirectories)
            .Where(f => f.EndsWith(".cs") || f.EndsWith(".tsx") || f.EndsWith(".ts"));
        
        foreach (var file in codeFiles)
        {
            var content = await File.ReadAllTextAsync(file);
            var lines = content.Split('\n');
            
            foreach (var (patternName, pattern) in patterns)
            {
                var matches = Regex.Matches(content, pattern.Regex, RegexOptions.IgnoreCase);
                foreach (Match match in matches)
                {
                    var lineNumber = content[..match.Index].Count(c => c == '\n') + 1;
                    vulnerabilities.Add(new CodeVulnerability
                    {
                        FilePath = file,
                        LineNumber = lineNumber,
                        CodeSnippet = lines[lineNumber - 1].Trim(),
                        PatternName = patternName,
                        CweId = pattern.CweId,
                        Severity = pattern.Severity,
                        Description = pattern.Description
                    });
                }
            }
        }
        
        return vulnerabilities;
    }
}

// === Dependency Check (SCA) ===
public class DependencyChecker
{
    public async Task<List<DependencyVulnerability>> CheckAsync(string projectPath)
    {
        // .NET: Check NuGet packages
        var csprojFiles = Directory.GetFiles(projectPath, "*.csproj", SearchOption.AllDirectories);
        var vulnerabilities = new List<DependencyVulnerability>();
        
        foreach (var csproj in csprojFiles)
        {
            var doc = XDocument.Load(csproj);
            var packages = doc.Descendants("PackageReference")
                .Select(p => new { 
                    Name = p.Attribute("Include")?.Value,
                    Version = p.Attribute("Version")?.Value 
                });
            
            foreach (var pkg in packages)
            {
                // Check against NVD / OSV database
                var cves = await _nvdClient.SearchAsync(pkg.Name!, pkg.Version!);
                vulnerabilities.AddRange(cves.Select(cve => new DependencyVulnerability
                {
                    PackageName = pkg.Name!,
                    CurrentVersion = pkg.Version!,
                    CveId = cve.Id,
                    CvssScore = cve.CvssScore,
                    FixedVersion = cve.FixedVersion,
                    Description = cve.Description
                }));
            }
        }
        
        return vulnerabilities;
    }
}

SLA by Severity

public static class VulnerabilitySla
{
    // NCA-ECC aligned SLAs
    public static readonly Dictionary<CvssSeverity, TimeSpan> RemediationSla = new()
    {
        { CvssSeverity.Critical, TimeSpan.FromHours(24) },     // 24 ساعة
        { CvssSeverity.High, TimeSpan.FromDays(7) },           // 7 أيام
        { CvssSeverity.Medium, TimeSpan.FromDays(30) },        // 30 يوم
        { CvssSeverity.Low, TimeSpan.FromDays(90) },           // 90 يوم
        { CvssSeverity.None, TimeSpan.FromDays(180) }          // 180 يوم
    };
}

SQL Schema

CREATE SCHEMA [Security];

CREATE TABLE [Security].[Vulnerabilities] (
    [Id] INT IDENTITY(1,1) PRIMARY KEY,
    [VulnId] NVARCHAR(50) NOT NULL UNIQUE,
    [Title] NVARCHAR(500) NOT NULL,
    [Description] NVARCHAR(MAX) NOT NULL,
    [Type] NVARCHAR(30) NOT NULL,
    [Category] NVARCHAR(50) NOT NULL,
    [CveId] NVARCHAR(20) NULL,
    [CweId] NVARCHAR(20) NULL,
    [CvssScore] DECIMAL(3,1) NOT NULL,
    [Severity] NVARCHAR(10) NOT NULL,
    [IsExploitedInWild] BIT NOT NULL DEFAULT 0,
    [HasPublicExploit] BIT NOT NULL DEFAULT 0,
    [AssetId] INT NOT NULL,
    [Source] NVARCHAR(30) NOT NULL,
    [DiscoveredAt] DATETIME2 NOT NULL,
    [Status] NVARCHAR(20) NOT NULL DEFAULT 'New',
    [AssignedToId] INT NULL,
    [RemediationDueDate] DATETIME2 NULL,
    [RemediatedAt] DATETIME2 NULL,
    [IsSlaBreached] BIT NOT NULL DEFAULT 0,
    [CreatedAt] DATETIME2 NOT NULL DEFAULT GETUTCDATE(),
    INDEX IX_Severity_Status ([Severity], [Status]),
    INDEX IX_Asset ([AssetId])
);

CREATE TABLE [Security].[Incidents] (
    [Id] INT IDENTITY(1,1) PRIMARY KEY,
    [IncidentNumber] NVARCHAR(50) NOT NULL UNIQUE,
    [Title] NVARCHAR(500) NOT NULL,
    [Severity] NVARCHAR(10) NOT NULL,
    [Type] NVARCHAR(30) NOT NULL,
    [Status] NVARCHAR(20) NOT NULL DEFAULT 'Detected',
    [DataBreached] BIT NOT NULL DEFAULT 0,
    [DetectedAt] DATETIME2 NOT NULL,
    [ContainedAt] DATETIME2 NULL,
    [RecoveredAt] DATETIME2 NULL,
    [IncidentCommanderId] INT NULL,
    [CreatedAt] DATETIME2 NOT NULL DEFAULT GETUTCDATE()
);

CREATE TABLE [Security].[Assets] (
    [Id] INT IDENTITY(1,1) PRIMARY KEY,
    [Name] NVARCHAR(200) NOT NULL,
    [Type] NVARCHAR(30) NOT NULL,
    [IpAddress] NVARCHAR(45) NULL,
    [Hostname] NVARCHAR(200) NULL,
    [Criticality] NVARCHAR(10) NOT NULL DEFAULT 'Medium',
    [DepartmentId] INT NOT NULL,
    [LastScanDate] DATETIME2 NULL,
    [OpenVulnerabilities] INT NOT NULL DEFAULT 0
);

-- Dashboard Views
CREATE VIEW [Security].[vw_VulnDashboard] AS
SELECT 
    Severity,
    Status,
    COUNT(*) AS VulnCount,
    SUM(CASE WHEN IsSlaBreached = 1 THEN 1 ELSE 0 END) AS SlaBreachedCount,
    AVG(CvssScore) AS AvgCvssScore
FROM [Security].[Vulnerabilities]
GROUP BY Severity, Status;

CREATE VIEW [Security].[vw_CriticalOpenVulns] AS
SELECT v.*, a.Name AS AssetName, a.Criticality AS AssetCriticality
FROM [Security].[Vulnerabilities] v
JOIN [Security].[Assets] a ON a.Id = v.AssetId
WHERE v.Status NOT IN ('Remediated','Verified','Closed')
    AND (v.Severity IN ('Critical','High') OR v.IsExploitedInWild = 1)
ORDER BY v.CvssScore DESC, v.DiscoveredAt;

NCA-ECC Controls Mapping