| name | verify-fix |
| description | Post-fix verification — re-scan the repo, gate on `--exploits weaponized --severity high`, recheck the specific CVE against the new installed version, write the verdict to `.vulnetix/memory.yaml`. Use when confirming a fix landed, validating a version bump did not introduce regressions, or producing a clean-scan attestation for compliance. |
| argument-hint | <vuln-id> |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["verify fix","confirm fix","fix worked","exploit gone"] |
| chain | ["vex-publish"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix Fix Verification Skill
Use when
- You just applied a fix via
/vulnetix:fix and need PASS/FAIL confirmation.
- Validating a peer-dep upgrade chain did not introduce new vulnerabilities.
- Producing a clean-scan attestation for a compliance bundle.
- Pre-release: confirming all triaged P1/P2 items are resolved.
- Setting decision status from
under_investigation to fixed with audit trail.
Don't use for
- Initial scanning — use
/vulnetix:scan or /vulnetix:soc-triage.
- Applying the fix — use
/vulnetix:fix first.
- Multi-CVE upgrade verification — use
@dep-upgrade-orchestrator agent.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Run after /vulnetix:fix (or any manual remediation) to confirm the vulnerability is gone and no regressions appeared.
Step 1: Load capabilities + memory
Read .vulnetix/capabilities.yaml and .vulnetix/memory.yaml. Find the entry for $ARGUMENTS. Capture: package, fixed_version, manifest path.
Step 2: Pre-flight
git diff --name-only HEAD~5 -- "<manifest_path>" 2>/dev/null
If no recent change to the manifest, warn the user and proceed.
Step 3: Run gated scan
vulnetix scan \
--evaluate-sca \
--severity high \
--exploits weaponized \
-o json
Capture exit code. Non-zero means a critical/high vuln with weaponized exploit signal still present.
Step 4: Targeted recheck of the specific CVE
