threat-feed

name	threat-feed
description	Daily threat-intel digest — AI-discovered vulnerabilities, AI-in-the-wild exploitation observations, AI-authored malware families, exploit-trends rollup, vendor-trends month-over-month deltas. Use when producing a weekly security newsletter, scanning for novel threats, monitoring vendors with rising CVE counts, or tracking AI-discovered vulns from the researcher leaderboard.
argument-hint	[--vendor X] [--ecosystem Y] [--limit N]
user-invocable	true
allowed-tools	Bash, Read, Glob, Grep
model	sonnet
triggers	["threat intel","threat feed","weekly digest","ai discoveries"]
chain	["soc-triage","kev-watch"]
outputBudget	medium
cooldown	per-session

Vulnetix Threat Feed Skill

Use when

• Producing a weekly threat-intel digest for the team.
• Scanning for novel AI-discovered vulnerabilities since last week.
• Monitoring a specific vendor (--vendor microsoft) for rising CVE counts.
• Tracking AI-authored malware families relevant to your stack.
• Spotting in-the-wild exploitation observations from the AI corpus.

Don't use for

• Single-CVE deep-dive — use /vulnetix:vuln or /vulnetix:exploits.
• Repo-specific intersection — use /vulnetix:soc-triage or /vulnetix:kev-watch.
• Detection rule generation — use /vulnetix:detection-rules.

Conventions

This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.

Compact daily digest — five concurrent VDB calls merged into one report.

Step 1: Load capabilities

Read .vulnetix/capabilities.yaml. Use derived.primary_package_manager to choose default --ecosystem if not provided.

Step 2: Fetch in parallel

vulnetix vdb ai-discoveries -o json --limit 20 | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/ai-list.jq"
vulnetix vdb ai-in-wild -o json --limit 20 | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/ai-list.jq"
vulnetix vdb ai-malware -o json --limit 10 | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/ai-list.jq"
vulnetix vdb exploit-trends -o json
vulnetix vdb vendor-trends -o json

Honor user --vendor, --ecosystem flags by passing them to each call where supported.

Step 3: Render digest

Sections, each at most 5 rows:

1. Newly discovered (AI researchers) — CVE, package, CVSS, researcher
2. Active in the wild — CVE, package, sightings count, first-seen
3. Malware families (AI-authored / AI-runtime) — family, package targets, severity
4. Exploit trends (rollup) — Mermaid pie or bar chart by severity tier
5. Vendor trends — top 5 vendors by month-over-month CVE delta

Step 4: Repo overlay (one extra section)

For each item across sections, mark In repo? if affected package is in lockfiles. Surface only the in-repo subset in a final "Concerns for this repo" table.

No memory writes

This skill is read-only. No memory.yaml update.

Edge cases & gotchas

• Five parallel VDB calls — ai-discoveries, ai-in-wild, ai-malware, exploit-trends, vendor-trends. Stagger by 1s if hitting community-tier rate limits.
• vdb ai-discoveries lists CVEs WITH a researcher attribution; absence does not mean undiscovered, it means "no AI researcher claimed it in our corpus".
• vdb ai-malware covers AI-authored OR AI-runtime-targeted families; the .family field disambiguates.
• exploit-trends rollup is a severity-tier histogram by count, not per-CVE — pair with exploits-search for drill-down.
• For --vendor filtering across the four AI endpoints, the field name varies (vendor vs vendorProject vs productVendor); the jq filter normalises to .package // .family.
• No user-specific filtering — --ecosystem is the only narrowing arg. Cross-correlate with installed deps client-side.