| name | soc-triage |
| description | SOC daily-pull triage feed — Vulnetix's score-driven queue cross-referenced with installed dependencies. Use when starting a SOC shift, prioritising the queue by EPSS × KEV × repo-impact, filtering by severity / ecosystem / KEV-only / since-date, producing a P1–P4 action list grouped by package manager, or handing off a watchlist to the next shift. |
| argument-hint | [--severity high|critical] [--limit N] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep |
| model | sonnet |
| triggers | ["triage","prioritize vulns","soc queue","daily soc"] |
| chain | ["vuln","fix","verify-fix"] |
| outputBudget | medium |
| cooldown | per-session |
Vulnetix SOC Triage Skill
Use when
- Start of a SOC shift: "what landed overnight that hits our deps?".
- Building today's P1–P4 action list grouped by package manager.
- Filtering for KEV-only or EPSS > 0.5 items intersected with installed packages.
- Producing a handoff watchlist for the next shift.
- Weekly all-hands prep: top 10 items the team should know about.
Don't use for
- Single-CVE deep-dive — use
/vulnetix:vuln or /vulnetix:exploits.
- Cross-CVE exploit search by ecosystem — use
/vulnetix:exploits-search.
- Applying fixes — use
/vulnetix:fix per item.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
The "daily SOC pull" — fetches Vulnetix's score-driven triage feed, narrows it to ecosystems / packages this repo actually uses (per .vulnetix/capabilities.yaml), and produces a ranked action list.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Use derived.primary_package_manager and the repo.* flags to choose the ecosystem filter. If the file is missing, run ${CLAUDE_PLUGIN_ROOT}/hooks/capabilities-detect.sh first.
Step 2: Verify CLI availability
command -v vulnetix &>/dev/null || (see /vulnetix:vuln Step "CLI Availability" for install)
Step 3: Pull the triage feed
vulnetix vdb triage $ARGUMENTS -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/triage.jq"
Default arguments: --limit 50. Honor user-supplied , , , , , flags by passing through .
