remediation

**CRITICAL**: Use this skill for ALL CVE remediation workflows. DO NOT use individual skills piecemeal for end-to-end remediation. Use when users request: - CVE remediation playbooks or security patch deployment - Multi-step remediation (validation → context → playbook → execution) - Batch remediation across multiple systems or CVEs - End-to-end CVE management (analysis + remediation + verification) - Prioritizing and remediating CVEs (not just listing them) - Emergency security response with immediate remediation plans DO NOT use for simple queries: - "List critical CVEs" → Use `/cve-impact` skill - "What's the CVSS score for CVE-X?" → Use `/cve-impact` or `/cve-validation` - Standalone impact analysis without remediation → Use `/cve-impact` This skill orchestrates 6 specialized skills (cve-impact, cve-validation, system-context, playbook-generator, playbook-executor, remediation-verifier) for complete remediation workflows.

Quality

—

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Advisory

Suggest reviewing before use

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a highly actionable, well-sequenced orchestration workflow with strong validation checkpoints. Its main weaknesses are redundant human-in-the-loop restatements and several broken reference links that undermine progressive disclosure.

Suggestions

Remove or consolidate the 'Critical: Human-in-the-Loop Requirements' and 'Important Reminders' sections, since their gating rules already appear inline in the relevant workflow steps.

Create the missing referenced files (skill-invocation.md, lightspeed-mcp-tool-failures.md, cve-remediation-templates.md, package-management.md, cve-validation/references/01-remediation-indicators.md) or remove the dead links so navigation is not broken.

Tighten repeated MANDATORY/CRITICAL emphasis where the same instruction (e.g. wait for user confirmation before Step 5) is stated three or more times.

Dimension	Reasoning	Score
Conciseness	Mostly efficient orchestration guidance, but the 'Critical: Human-in-the-Loop Requirements' and 'Important Reminders' sections duplicate gating rules already stated inline in Steps 0, 4, and 5, adding redundant tokens.	2 / 3
Actionability	Provides exact invoke strings, expected outputs, gating field names (remediation_status.automated_remediation_available), absolute Write paths, and ready-made error messages — copy-paste ready.	3 / 3
Workflow Clarity	Steps 0–6 are strictly sequenced with 'do not proceed until Step N returns' rules, a remediatable gate, mandatory user-validation checkpoints, and dry-run feedback loops for destructive execution.	3 / 3
Progressive Disclosure	Sections are well organized and the one working reference (references/01-remediation-plan-template.md) is clearly signaled, but five of the six referenced paths (docs/references/skill-invocation.md, lightspeed-mcp-tool-failures.md, docs/ansible/cve-remediation-templates.md, docs/rhel/package-management.md, ../cve-validation/references/01-remediation-indicators.md) do not exist in the bundle, breaking navigation.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and explicitly distinguishes this orchestrator from the individual skills it delegates to. It cleanly answers both what the skill does and when to use it.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'CVE remediation playbooks or security patch deployment', 'Batch remediation across multiple systems or CVEs', and 'orchestrates 6 specialized skills' — rather than vague language.	3 / 3
Completeness	Explicitly answers both what ('orchestrates 6 specialized skills ... for complete remediation workflows') and when (a dedicated 'Use when users request' list plus 'DO NOT use for simple queries' negative triggers).	3 / 3
Trigger Term Quality	Covers natural user phrasings such as 'CVE remediation playbooks', 'security patch deployment', 'Emergency security response', and 'Prioritizing and remediating CVEs' that a user would actually say.	3 / 3
Distinctiveness Conflict Risk	The negative-trigger examples redirect overlapping requests to /cve-impact and /cve-validation, carving a clear end-to-end remediation niche unlikely to fire for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

75%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 12 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 6 missing, 6 deeper-than-1-level, 1 suspicious	Warning
referenced_paths_exist	Referenced path issues: 1 missing	Warning

	Total	12 / 16 Passed

Repository: RHEcosystemAppEng/agentic-collections
Commit: 523e305

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.