| name | vex-publish |
| description | Generate OpenVEX / CycloneDX VEX attestations from `.vulnetix/memory.yaml` triage decisions, optionally sign with cosign, optionally upload to Vulnetix and post to a GitHub PR. Use when documenting triage decisions for supply-chain consumers, attaching VEX to a CycloneDX SBOM, or satisfying customer attestation requests. |
| argument-hint | [--format openvex|cyclonedx] [--upload] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["vex","publish vex","openvex","attestation"] |
| chain | ["compliance-report"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix VEX Publication Skill
Use when
- Triage cycle is complete and you need to publish VEX statements for supply-chain consumers.
- A customer requested OpenVEX attestations for a specific delivery.
- Attaching VEX to a CycloneDX SBOM in a compliance bundle.
- Posting VEX status as a PR comment so reviewers see the security disposition.
- Auditing the decision history — VEX is the durable record of what was decided when.
Don't use for
- Making the triage decisions — use
/vulnetix:vuln, /vulnetix:exploits, /vulnetix:fix first; this skill publishes existing decisions.
- Generating the SBOM itself — use
/vulnetix:sbom-generate.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Turns the decisions captured in .vulnetix/memory.yaml into a signed/uploadable VEX document.
Step 1: Load memory
Read .vulnetix/memory.yaml. Collect every entry with a non-default decision.choice (i.e. anything that isn't investigating).
Step 2: Map decisions → VEX status
Mapping (Vulnetix CLI uses the same):
not-affected / risk-avoided → not_affectedfix-applied → fixedrisk-accepted / deferred / mitigated → affected (with mitigations)investigating → under_investigation
Step 3: Generate VEX
vulnetix triage --provider vulnetix --vex-format ${FORMAT:-openvex} -o json > .vulnetix/vex/.vex.json
