Documentation

Skills

The 18 local procedures. Each one needs your repository, your input, or a sequence a model would not compose correctly alone.

A skill earns its place here when it needs the repository, needs the user, or needs a sequence. Looking a fact up is none of those, which is why the eleven skills that wrapped a single lookup were removed: the MCP tools and the CLI’s own subcommands already answered those, and three descriptions competing for one question is worse than one.

SkillThe one questionGrants
container-scanDockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present.Bash(vulnetix:*) Read Grep Glob Bash(syft:*) Bash(grype:*) Bash(trivy:*)
dashboardShow what this repository has already decided about its vulnerabilities, read from the durable record rather than by scanning again — open versus resolved, the decision taken on each, and what is still waiting.Bash(vulnetix:*) Read Grep Glob
dep-resolveDependency-conflict resolution when a fix version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (overrides/resolutions/replace/[patch]), fall back to safe-harbour inline patching.Bash(vulnetix:*) Read Grep Glob Edit Bash(npm:*) Bash(yarn:*) Bash(pnpm:*) Bash(pip:*) Bash(cargo:*) Bash(go:*)
dependency-choiceWork through which package to add for a capability, and what each option costs — maintenance, licence, bundle weight, transitive risk, and whether the platform already does it.Bash(vulnetix:*) Read Grep Glob
detection-rulesIDS/IPS detection content for a CVE — Snort/Suricata-compatible rules, YARA signatures, ProjectDiscovery Nuclei templates, traffic-filter rules.Bash(vulnetix:*) Read Grep Glob Write
eol-checkEnd-of-life detection for runtimes (Node, Python, Java, Go, .NET) and key packages — surfaces past-EOL items, items reaching EOL within 90 days, and EOL base images for containers.Bash(vulnetix:*) Read Grep Glob
exploit-testGenerate a runnable exploit-validation command (Nuclei template, Metasploit module hint, AI-assisted Python script, or curl-based PoC) against a user-specified authorised target.Bash(vulnetix:*) Read Grep Glob Bash(nuclei:*)
fixConcrete remediation proposal with Safe Harbour confidence — version bump, inline as first-party code, patch, workaround, or advisory.Bash(vulnetix:*) Read Grep Glob Edit
iac-scanTerraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags.Bash(vulnetix:*) Read Grep Glob
license-checkPackage license analysis — detect copyleft conflicts against a permissive policy, surface AGPL / SSPL / GPL contaminants, output SPDX SBOM with per-package license findings.Bash(vulnetix:*) Read Grep Glob
repo-impactAnswer whether a specific advisory reaches anything in THIS repository — which manifest declares the package, at what version, whether the version is in range, and whether the vulnerable code is reachable.Bash(vulnetix:*) Read Grep Glob
sast-scanStatic application security testing (SAST) for changed source files — Vulnetix’s built-in rule set plus optional Semgrep augmentation when .semgrep config is present.Bash(vulnetix:*) Read Grep Glob Bash(semgrep:*)
sbom-generateGenerate CycloneDX 1.7 and/or SPDX 2.3 SBOMs for the repo, optionally cosign-signed, optionally cross-validated against syft output.Bash(vulnetix:*) Read Grep Glob Write Bash(syft:*) Bash(cosign:*)
secret-scanHardcoded-secret detection — AWS keys, GitHub PATs, Slack tokens, Stripe keys, generic high-entropy strings.Bash(vulnetix:*) Read Grep Glob
secure-code-writeProactive secure-coding coach scoped to the file or topic you are working on — surfaces relevant SAST rule IDs, CWE patterns, language-specific PASS/FAIL code snippets.Bash(vulnetix:*) Read Grep Glob
typosquat-checkTyposquat and malicious-package detection across installed dependencies (or a single prospective addition) — cross-checks AI-malware family intelligence, package-name similarity to known popular packages, low maintainer-health signals.Bash(vulnetix:*) Read Grep Glob
verify-fixPost-fix verification — re-scan the repo, gate on --exploits weaponized --severity high, recheck the specific CVE against the new installed version, write the verdict to .vulnetix/memory.yaml.Bash(vulnetix:*) Read Grep Glob Bash(git:*)
vex-publishGenerate OpenVEX / CycloneDX VEX attestations from .vulnetix/memory.yaml triage decisions, optionally sign with cosign, optionally upload to Vulnetix and post to a GitHub PR.Bash(vulnetix:*) Read Grep Glob Write Bash(cosign:*) Bash(gh:*)

allowed-tools is scoped to what each body actually runs. No skill gets bare Bash; no read-only skill gets Write.

container-scan
Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present.
dashboard
Show what this repository has already decided about its vulnerabilities, read from the durable record rather than by scanning again — open versus resolved, the decision taken on each, and what is still waiting.
dep-resolve
Dependency-conflict resolution when a `fix` version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (`overrides`/`resolutions`/`replace`/`[patch]`), fall back to safe-harbour inline patching.
dependency-choice
Work through which package to add for a capability, and what each option costs — maintenance, licence, bundle weight, transitive risk, and whether the platform already does it.
detection-rules
IDS/IPS detection content for a CVE — Snort/Suricata-compatible rules, YARA signatures, ProjectDiscovery Nuclei templates, traffic-filter rules.
eol-check
End-of-life detection for runtimes (Node, Python, Java, Go, .NET) and key packages — surfaces past-EOL items, items reaching EOL within 90 days, and EOL base images for containers.
exploit-test
Generate a runnable exploit-validation command (Nuclei template, Metasploit module hint, AI-assisted Python script, or curl-based PoC) against a user-specified authorised target.
fix
Concrete remediation proposal with Safe Harbour confidence — version bump, inline as first-party code, patch, workaround, or advisory.
iac-scan
Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags.
license-check
Package license analysis — detect copyleft conflicts against a permissive policy, surface AGPL / SSPL / GPL contaminants, output SPDX SBOM with per-package license findings.
repo-impact
Answer whether a specific advisory reaches anything in THIS repository — which manifest declares the package, at what version, whether the version is in range, and whether the vulnerable code is reachable.
sast-scan
Static application security testing (SAST) for changed source files — Vulnetix's built-in rule set plus optional Semgrep augmentation when `.semgrep` config is present.
sbom-generate
Generate CycloneDX 1.7 and/or SPDX 2.3 SBOMs for the repo, optionally cosign-signed, optionally cross-validated against syft output.
secret-scan
Hardcoded-secret detection — AWS keys, GitHub PATs, Slack tokens, Stripe keys, generic high-entropy strings.
secure-code-write
Proactive secure-coding coach scoped to the file or topic you are working on — surfaces relevant SAST rule IDs, CWE patterns, language-specific PASS/FAIL code snippets.
typosquat-check
Typosquat and malicious-package detection across installed dependencies (or a single prospective addition) — cross-checks AI-malware family intelligence, package-name similarity to known popular packages, low maintainer-health signals.
verify-fix
Post-fix verification — re-scan the repo, gate on `--exploits weaponized --severity high`, recheck the specific CVE against the new installed version, write the verdict to `.vulnetix/memory.yaml`.
vex-publish
Generate OpenVEX / CycloneDX VEX attestations from `.vulnetix/memory.yaml` triage decisions, optionally sign with cosign, optionally upload to Vulnetix and post to a GitHub PR.