Patch
Triages CVEs using CVSS + EPSS + CISA KEV, designs patch SLA programs with asset-criticality tiers, and audits existing vuln management programs. Use when prioritizing a backlog of CVEs, designing a patching cadence, or finding SLA gaps. Trigger with \"triage our CVEs\", \"design a vulnerability management program\".
- Type
- Subagent
- Repository
- jeremylongshore/tons-of-skills-marketplace
- GitHub stars
- 2.8k
- License
- MIT
- Repo last updated
- Sep 27, 2026
- Source file
- plugins/ai-agency/tonone/agents/patch.md
- Model
- sonnet
- Version
- 1.0.0
- Author
- Jeremy Longshore <[email protected]>
What Patch is
Patch is a subagent published in the jeremylongshore/tons-of-skills-marketplace repository on GitHub, which has about 2.8k stars. The repository describes itself as: “Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.”
A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.
Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Patch and get back a compact result.
How to install Patch
Claude Code
- Download patch.md from the repository.
- Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
- Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Claude Cowork
- Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
- Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/ai-agency/tonone/agents/patch.md, shared under the repository's MIT license. Read the full file on GitHub.
You are Patch — Vulnerability Management Engineer on the Security Operations Team. Designs vulnerability triage systems and patching programs that fix what matters before it's exploited.
Think in attacker TTPs, defense-in-depth, and risk reduction. Every security recommendation must be paired with a business impact statement. Perfect security that prevents operations is not security — it's obstruction.
Communication
Respond terse. All security substance stays — only filler dies. Follow output-kit protocol: compressed prose, no filler, fragments OK. Documents: normal prose. See docs/output-kit.md for CLI skeleton, severity indicators, 40-line rule.
Operating Principle
Not all CVEs are equal. A CVSS 9.8 with no public exploit in a non-internet-facing system is less urgent than a CVSS 7.5 with a weaponized exploit in a public-facing API. Prioritize by exploitability (EPSS score), exposure (internet-facing vs internal), and asset criticality. CISA KEV (Known Exploited Vulnerabilities) catalog is the ground truth for 'being exploited now.'
What you skip: Actual vulnerability scanning tooling — that's Sast. Patch handles triage and program design; Sast handles detection.
What you never skip: Never prioritize by CVSS alone — always factor in EPSS and CISA KEV. Never set patch SLAs without asset criticality tiers. Never close a vuln without a verification step.
Scope
Owns: CVE triage, CVSS + EPSS prioritization, patch SLA design, vulnerability lifecycle management
Skills
- Patch Triage: Triage a set of CVEs — CVSS + EPSS + KEV scoring, prioritization, and recommended remediation order.
- Patch Plan: Design a vulnerability management program — SLAs, asset tiers, escalation, and metrics.
- Patch Recon: Audit existing vulnerability management — find SLA gaps, missing tiers, and process failures.
Key Rules
- CISA KEV: anything on KEV catalog is Critical priority regardless of CVSS
- EPSS: probability of exploitation in 30 days — combine with CVSS for real priority
- SLA tiers: Critical (KEV/EPSS>0.7) 24h, High 7d, Medium 30d, Low 90d
- Asset criticality: internet-facing + PII/payment data = Tier 1, adjusts all priorities up
- Verification: rescan after patch; never close without confirming remediation
Process Disciplines
When performing Patch work, follow these superpowers process skills:
Iron rule: No completion claims without fresh verification.
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Patch?
Patch is a subagent for Claude Code and Claude Cowork from the jeremylongshore/tons-of-skills-marketplace repository on GitHub. Triages CVEs using CVSS + EPSS + CISA KEV, designs patch SLA programs with asset-criticality tiers, and audits existing vuln management programs. Use when prioritizing a backlog of CVEs, designing a patching cadence, or finding SLA gaps. Trigger with \"triage our CVEs\", \"design a vulnerability management program\".
How do I install Patch in Claude Code?
Download patch.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Can I use Patch in Claude Cowork?
Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
Is Patch safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Rag Pipeline Gen Generate complete RAG pipeline with embeddings, vector DB, and retrieval Slash Command · jeremylongshore/tons-of-skills-marketplace
- Real User Monitoring Implement Real User Monitoring for actual performance data Plugin · jeremylongshore/tons-of-skills-marketplace
- Recommendation Engine Build recommendation systems and engines Plugin · jeremylongshore/tons-of-skills-marketplace
- Record Start, stop, pause, or mark moments in screen recordings with organized file Slash Command · jeremylongshore/tons-of-skills-marketplace
- Pave Builds golden paths, service catalogs, internal CLIs, scaffolding, and local dev environments that measurably improve DORA metrics for the current team. Use when onboarding takes more than a day, dev environments are snowflakes, or releases require tribal knowledge. Trigger with \"friction audit my developer experience\", \"build the golden path\". Subagent · jeremylongshore/tons-of-skills-marketplace
- Owner Router Recommend likely bug owners using strict 6-level routing precedence with staleness detection and override memory. Use when routing clustered bugs to teams after evidence gathering. Subagent · jeremylongshore/tons-of-skills-marketplace
- Penetration Tester Ethical hacking specialist covering MITRE ATT&CK phases, web/API/network penetration testing, and exploit chain documentation. Use when running an authorized pen test, simulating attack scenarios, or writing a findings report with proof-of-concept exploits. Trigger with \"pen test this\", \"red team assessment\". Subagent · jeremylongshore/tons-of-skills-marketplace
- Overnight Dev Coach Autonomous overnight development coach that enforces TDD, runs Git hook–gated sessions, debugs failing tests iteratively, and delivers a morning handoff report when all tests are green. Use when you want to run an unattended overnight coding session or set up TDD workflows. Trigger with \"overnight session\", \"autonomous TDD run\". Subagent · jeremylongshore/tons-of-skills-marketplace