| name | detection-rules |
| description | IDS/IPS detection content for a CVE — Snort/Suricata-compatible rules, YARA signatures, ProjectDiscovery Nuclei templates, traffic-filter rules. Capability-aware: skips families when the binary is not installed (no Snort = no Snort output). Use when deploying defences for a CVE without a patch, augmenting SAST with active detection, or feeding the SOC engineering pipeline. |
| argument-hint | <vuln-id> |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["detection rules","snort","yara","nuclei","ids rules"] |
| chain | ["exploit-test","verify-fix"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix Detection Rules Skill
Use when
- A CVE has no patch yet and you need detection-only mitigation.
- Augmenting SAST with active runtime detection (Snort/Suricata).
- Feeding the SOC engineering pipeline with rule files.
- Building a Nuclei scan template for an authorised target assessment.
- Hardening a YARA ruleset against a newly-discovered malware family.
Don't use for
- Executing the rules — this skill writes files; the user runs the engine.
- Patching the underlying issue — use
/vulnetix:fix.
- Single-CVE enrichment — use
/vulnetix:vuln.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Pulls IDS/IPS, malware-detection, and active-scan content for a CVE. Capability-aware: only fetches rule families the user can actually use.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Capture derived.detection_stack. If empty, prompt:
No detection tooling found (snort, suricata, yara, nuclei, semgrep). I can still fetch the raw rules — proceed?
If the user accepts, treat the stack as [snort, yara, nuclei] for completeness. Otherwise abort with a one-liner pointing at install docs.
Step 2: Fetch each available family
For each family in detection_stack:
vulnetix vdb snort-rules get "$ARGUMENTS" -o json
vulnetix vdb traffic-filters "$ARGUMENTS" -o json
vulnetix vdb yara-rules get "$ARGUMENTS" -o json
vulnetix vdb nuclei get -o json
