Vulnetix Vulnerability Dashboard

This skill reads .vulnetix/memory.yaml and displays a comprehensive vulnerability status report. It is read-only and does not modify any files.

Workflow

Step 1: Load Memory

1. Use Glob to check if .vulnetix/memory.yaml exists in the repo root
2. If it does not exist, display: "No vulnerability data found. Run `/vulnetix:vuln <package>` or `/vulnetix:exploits-search` to start tracking." and stop.
3. Use Read to load the full contents of .vulnetix/memory.yaml

Step 2: Parse and Categorize

From the vulnerabilities: section, categorize each entry:

Open (unresolved):

• status: affected -- "Vulnerable"
• status: under_investigation -- "Investigating"

Resolved:

• status: fixed -- "Fixed"
• status: not_affected -- "Not affected"
• Entries with decision.choice: risk-accepted -- "Risk accepted"
• Entries with decision.choice: deferred -- "Deferred"

From the manifests: section, collect manifest tracking info.

Step 3: Display Summary Header

Vulnetix Security Dashboard
============================
Open: <N> (<X> vulnerable, <Y> investigating)
Resolved: <N> (<X> fixed, <Y> not affected, <Z> risk-accepted, <W> deferred)
Manifests tracked: <N> (last scan: <timestamp>)

If there are zero vulnerabilities and zero manifests, display: "Clean slate -- no vulnerabilities tracked yet."

Step 4: Open Vulnerabilities Table

If there are open vulnerabilities, display them sorted by CWSS priority (P1 first), then by severity:

Open Vulnerabilities
--------------------
| ID | Package | Severity | Status | Priority | Decision |
|----|---------|----------|--------|----------|----------|
| CVE-2021-44228 | log4j-core | critical | Vulnerable | P1 (87.5) | investigating |
| GHSA-xxxx-yyyy | express | high | Investigating | P2 (62.0) | investigating |

For each column:

• ID: Primary vulnerability key
• Package: package field
• Severity: severity field
• Status: Developer-friendly status (see VEX mapping above)
• Priority: cwss.priority and cwss.score if available, otherwise "--"
• Decision: decision.choice if available, otherwise "--"

Step 5: Resolved Vulnerabilities Table

If there are resolved vulnerabilities, display them:

Resolved Vulnerabilities
------------------------
| ID | Package | Severity | Resolution | Decision | Date |
|----|---------|----------|------------|----------|------|
| CVE-2023-1234 | lodash | high | Fixed | fix-applied | 2024-01-15 |

For the Date column, use the most recent history entry timestamp, or discovery.date as fallback.

Step 6: Manifest Tracking

If manifests are tracked, display:

Tracked Manifests
-----------------
| Manifest | Ecosystem | Last Scanned | Vulns Found |
|----------|-----------|--------------|-------------|
| package.json | npm | 2024-01-15T10:30:00Z | 3 |
| go.mod | go | 2024-01-15T10:31:00Z | 0 |

Step 7: Suggested Actions

For each open vulnerability (up to 5), suggest a next action based on its state:

• Has no threat_model or cwss: "/vulnetix:exploits <id>" -- get exploit analysis and priority scoring
• Has cwss but no fix applied: "/vulnetix:fix <id>" -- get fix intelligence
• General: "/vulnetix:remediation <id>" -- get a full remediation plan

If there are more than 5 open vulns, add: "Use /vulnetix:exploits-search to find exploited vulnerabilities across your ecosystem."

Always end with: "Use /vulnetix:vuln <id> for detailed info on any vulnerability."