# Remediation Priority & Impact Agent

> Prioritizes daily vulnerability fixes using Tenable exposure data, CISA KEV exploitation, MITRE ATT&CK and attack paths

- Type: Skill
- Author: smjennings
- License: MIT
- Trust tier: vetted (passed the Exchange Inspector security review process)
- Vetted on: 2026-09-23
- Vetted commit: 536616fb6f7bc5480ed61492f1a2bb5cf4e7edc8. The security review covers that commit only; anything pushed after it is unreviewed
- Commits since vetted: 0 (0 means the reviewed code is current)
- Last reviewed: 2026-09-23
- Source repository: https://github.com/smjennings/Remediation_Priority-Impact_Agent
- Repo state: not archived
- Last push: 2026-09-16T13:35:05Z
- Stars: 8 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Tenable Hexa AI MCP
- Domains: vulnerability-management
- Tags: vulnerability-management, exposure-management, remediation-prioritization, cisa-kev, mitre-attack, attack-path-analysis
- Date added: 2026-06-18
- Works with the Tenable Hexa AI MCP server: yes
- Compatible platforms: Claude Code
- Invocation: `/fix-today`
- Listing page: https://exchange.tenable.com/skills/remediation-priority-impact-agent
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/remediation-priority-impact-agent.md

A Claude Code skill that answers "What should I fix today?" by pulling live data from Tenable (Tenable One / Exposure Management and Vulnerability Management) and producing a prioritized remediation briefing.

## What it does

- **Ranks your most exposed assets** by Tenable's Asset Exposure Score (AES)
- **Confirms real exploited-in-the-wild status** from plugin exploit-intelligence (CISA KEV, exploited-by-malware, in-the-news, exploit frameworks) — not inferred from VPR
- **Layers MITRE ATT&CK and Attack Path Analysis**, sourced from Tenable's own APA where available, then CVE→tactic mapping
- **Scores each remediation** with a composite of AES, confirmed-exploit tier, VPR, asset criticality, attack-path position and blast radius
- **Surfaces the actual fix** — verbatim Tenable remediation (exact KBs, package versions, registry keys) plus interim mitigations
- **Renders an interactive dashboard** (priority table, ATT&CK heatmap, batched remediation groups, risk-reduction forecast) and a "Fix FIRST / NEXT / SOON" plan
- **Generates ready-to-paste change tickets** per host on request

## How it works

Invoked with `/fix-today`, the skill works through gather → confirm-exploitation → ATT&CK/attack-path mapping → prioritize phases, calling the Tenable MCP tools. It treats VPR as a ranking input only, confirming actual exploitation at the plugin level, and queries Tenable's Attack Path Analysis directly to flag the assets that sit on real attack paths (including identity/privilege pivots that patching won't fix). The output leads with what attackers are actually using, on the assets that matter most.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/remediation-priority-impact-agent.json. The full index and how to read it: https://exchange.tenable.com/llms.txt