Commands are thin, deterministic wrappers around vulnetix vdb subcommands. Unlike skills or agents, commands involve no LLM analysis – they execute the CLI, capture the JSON output, and display it in a structured format.
Use commands when you want raw VDB data without interpretation, or when you need to pipe exact output into another workflow.
Command Reference
VDB lookups
| Command | Wraps | Purpose |
|---|---|---|
| vdb-vuln | vulnetix vdb vuln | Look up a vulnerability by ID |
| vdb-vulns | vulnetix vdb vulns | List vulnerabilities for a package |
| vdb-affected | vulnetix vdb affected -V v2 | Affected products/packages |
| vdb-advisories | vulnetix vdb advisories -V v2 | Advisory data |
| vdb-fixes | vulnetix vdb fixes | Fix data (patches, advisories, distro) |
| vdb-workarounds | vulnetix vdb workarounds -V v2 | Workaround intelligence |
| vdb-remediation | vulnetix vdb remediation plan -V v2 | Context-aware remediation plan |
| vdb-scorecard | vulnetix vdb scorecard -V v2 | Vulnerability scorecard |
| vdb-cwe | vulnetix vdb cwe -V v2 | CWE intelligence |
| vdb-metrics | vulnetix vdb metrics | CVSS/EPSS metrics |
| vdb-vex | vulnetix vdb vex | VEX statements |
| vdb-purl | vulnetix vdb purl | Lookup by Package URL |
| vdb-versions | vulnetix vdb versions | All versions across ecosystems |
| vdb-product | vulnetix vdb product | Product version info |
| vdb-ecosystem | vulnetix vdb ecosystem | Ecosystem-scoped lookups |
| vdb-packages | vulnetix vdb packages search | Package search |
Exploit + threat intel
| Command | Wraps | Purpose |
|---|---|---|
| vdb-exploits-search | vulnetix vdb exploits search | Search exploited vulns |
| vdb-ai-discoveries | vulnetix vdb ai-discoveries | AI-discovered vulns |
| vdb-ai-in-wild | vulnetix vdb ai-in-wild | AI-discovered in-the-wild observations |
| vdb-ai-malware | vulnetix vdb ai-malware | AI malware family intelligence |
| vdb-ai-assisted-exploits | vulnetix vdb ai-assisted-exploits | AI-assisted exploit demos |
| vdb-iocs | vulnetix vdb iocs | IOC pivots (CrowdSec + Shadowserver) |
| vdb-sightings | vulnetix vdb sightings | Merged in-the-wild timeline |
| vdb-attack-techniques | vulnetix vdb attack-techniques | MITRE ATT&CK mappings |
| vdb-kev | vulnetix vdb kev | KEV catalogue |
| vdb-triage | vulnetix vdb triage | Score-driven triage feed |
| vdb-exploit-trends | vulnetix vdb exploit-trends | Severity-tier signal counts |
| vdb-vendor-trends | vulnetix vdb vendor-trends | Vendor monthly/yearly breakdown |
| vdb-timeline | vulnetix vdb timeline | Vuln lifecycle timeline |
Detection + reporting
| Command | Wraps | Purpose |
|---|---|---|
| vdb-snort-rules | vulnetix vdb snort-rules | Snort detection rules |
| vdb-yara-rules | vulnetix vdb yara-rules | YARA static-analysis rules |
| vdb-nuclei | vulnetix vdb nuclei | Nuclei templates |
| vdb-traffic-filters | vulnetix vdb traffic-filters | IDS/IPS traffic filter rules |
| vdb-msrc | vulnetix vdb msrc | Microsoft Patch Tuesday rollups |
| vdb-cloud-locators | vulnetix vdb cloud-locators -V v2 | Cloud resource locators |
| vdb-summary | vulnetix vdb summary | Global VDB stats |
| vdb-sources | vulnetix vdb sources | Vuln data sources |
| vdb-ids | vulnetix vdb ids | CVE IDs published in a calendar month |
| vdb-search | vulnetix vdb search | Search CVE IDs by prefix |
| vdb-gcve | vulnetix vdb gcve | CVEs by date range |
| vdb-raw | vulnetix vdb raw | Replay raw archived advisory bytes |
| vdb-spec | vulnetix vdb spec | OpenAPI specification |
| vdb-status | vulnetix vdb status | API health + CLI metadata |
| vdb-cache | vulnetix vdb cache | Manage local response cache |
Local scanners
| Command | Wraps | Purpose |
|---|---|---|
| scan | vulnetix scan | Full scan (configurable across SCA/SAST/secrets/license/container/IaC) |
| sast | vulnetix sast | SAST only |
| sca | vulnetix sca | SCA only |
| secrets | vulnetix secrets | Secret detection only |
| containers | vulnetix containers | Container/Dockerfile analysis |
| iac | vulnetix iac | Terraform/OpenTofu/Nix |
| license | vulnetix license | License conflicts |
| triage | vulnetix triage | Triage from GitHub or Vulnetix VDB |
Artifact upload + auth + meta
| Command | Wraps | Purpose |
|---|---|---|
| upload | vulnetix upload | Upload SBOM / SARIF / VEX / SPDX / CSAF |
| gha-upload | vulnetix gha upload | Batch upload from GitHub Actions |
| gha-status | vulnetix gha status | Poll GitHub Actions artifact status |
| auth-login | vulnetix auth login | Interactive auth |
| auth-status | vulnetix auth status | Auth status |
| env | vulnetix env | Current environment context |
| version | vulnetix version | CLI version |
Invocation
All commands use the colon syntax:
/vulnetix:<command-name> <arguments>
For example:
/vulnetix:vdb-vuln CVE-2021-44228
Commands are marked disable-model-invocation: true, meaning your coding agent will never call them autonomously – they only run when you invoke them explicitly.
Output
Every command appends -o json to the underlying CLI call and parses the JSON response into a human-readable summary. The raw JSON is always available in the command output if you need it for scripting or further processing.