| name | kev-watch |
| description | CISA + EU KEV (Known Exploited Vulnerabilities) catalog watch — pull recent KEV additions, intersect with installed dependencies, surface entries with imminent due dates. Use when checking if you have KEV-listed CVEs in your repo, monitoring CISA additions on a schedule, or producing a deadline-driven action list with `--since` filtering. |
| argument-hint | [--since YYYY-MM-DD] [--catalog cisa|eu|all] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep |
| model | sonnet |
| triggers | ["kev","known exploited","cisa kev"] |
| chain | ["soc-triage","fix"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix KEV Watch Skill
Use when
- You want to know "are any of our deps in CISA KEV right now?".
- Monitoring CISA additions since a date (
--since 2026-04-01).
- Producing a deadline-driven action list — items with KEV due dates within 14 days.
- Choosing between competing CVEs to patch first based on KEV listing.
- Pre-audit: ensuring no KEV items remain open past their due date.
Don't use for
- Per-CVE enrichment — use
/vulnetix:vuln.
- Daily SOC pull — use
/vulnetix:soc-triage (KEV is one signal among many there).
- Single-KEV lookup by CVE — use
vulnetix vdb kev get <id> directly.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Pulls the KEV catalog and intersects with installed packages — the "what's on fire and is it in my repo?" view.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Use derived.primary_package_manager to focus the lockfile scan.
Step 2: Pull KEV catalog
vulnetix vdb kev list $ARGUMENTS -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/kev.jq"
Honor --since, --catalog. Default --catalog all, --since = 30 days ago.
Step 3: Cross-reference repo
For each KEV entry:
- Extract affected package names.
- Grep lockfiles for matches (npm: package-lock.json/pnpm-lock.yaml; pypi: poetry.lock/uv.lock; etc.).
- Mark presence: direct / transitive / not-found.
If .vulnetix/scans/*.cdx.json SBOM exists, prefer that for matching.
