Vulnetix

Concrete remediation proposal with Safe Harbour confidence — version bump, inline as first-party code, patch, workaround, or advisory. Use when applying a fix for a triaged CVE, evaluating fix-type trade-offs across registry / source / distro patches,…

Dependency-conflict resolution when a `fix` version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (`overrides`/`resolutions`/`replace`/`[patch]`), fall back to safe-harbour inline patching. Use…

Post-fix verification — re-scan the repo, gate on `--exploits weaponized --severity high`, recheck the specific CVE against the new installed version, write the verdict to `.vulnetix/memory.yaml`. Use when confirming a fix landed, validating a version bump…

Proactive secure-coding coach scoped to the file or topic you are working on — surfaces relevant SAST rule IDs, CWE patterns, language-specific PASS/FAIL code snippets. Use when about to write auth, crypto, SQL, deserialization, file-handling, or template…

Typosquat and malicious-package detection across installed dependencies (or a single prospective addition) — cross-checks AI-malware family intelligence, package-name similarity to known popular packages, low maintainer-health signals. Use when auditing a…

Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry…

Show what this repository has already decided about its vulnerabilities, read from the durable record rather than by scanning again — open versus resolved, the decision taken on each, and what is still waiting. Use when picking up triage after a break,…

Work through which package to add for a capability, and what each option costs — maintenance, licence, bundle weight, transitive risk, and whether the platform already does it. Use when someone needs a library for a job and has not picked one yet, when…

Implements one kanban build item on its own worktree branch with the smallest change, proves it with a check that failed before, and publishes a draft pull request for review. Use when the claimed item is labelled build, when review notes need addressing, or…

Remediates one vulnerability finding on its own branch: finds the resolution path, picks the lowest fixed version, applies the narrowest per-ecosystem mechanism (lockfile update, parent bump, override, replacement, code fix), re-scans, and files an honest…

Review a built branch against the kanban item it was made for, run its build, tests and scanners on the exact head commit, then approve with shown evidence or send it back with precise, ordered notes. Use when judging a diff, pull request or merge request for…

Test-gap, coverage and flaky-test scouting for a kanban card in a delivery crew. Surveys a repository read-only, runs its own detected suites, ranks untested or weakly tested risk (uncovered branches, failing or flaky tests, packages with no tests, mutation…

Independently verifies a patcher's or scout's security claim (fixed, false positive, no known fix, needs a human) by re-deriving it from the scanner, lockfiles, resolution output and the shipped artefact, then records one verdict with a VEX justification. Use…

Specialist brief for the Belai vulnerability scout. Triage and prioritise findings from Vulnetix SCA, SAST, secrets, IaC and container scans in any customer repository: ground each finding in manifests, scope, reachability and exploitation evidence (KEV,…