| name | capabilities-detect |
| description | Detect installed security binaries (nuclei, snort, yara, semgrep, syft, grype, trivy, cosign, gh, package managers) and repo signals (manifests, Dockerfiles, IaC, CI configs); write .vulnetix/capabilities.yaml. Use when starting a session, after installing a new tool (brew install yara), when other Pix skills emit "unknown capability" notes, or to force-refresh stale capability state. |
| user-invocable | true |
| allowed-tools | Bash, Read |
| model | haiku |
| triggers | ["capabilities","probe environment","what tools","detect tools"] |
| chain | ["dashboard"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix Capabilities Detector
Use when
- A session just started and
.vulnetix/capabilities.yaml does not exist or is older than 24h.
- A new security tool was just installed (
brew install yara, pip install semgrep) and you want subsequent Pix calls to pick it up.
- The repo gained a new manifest type, Dockerfile, or
*.tf file and you want downstream skills to scope their behaviour.
- You need to inspect what Pix currently believes about the environment before debugging a skill.
- A downstream skill reports "unknown capability" or fetches rule families you cannot use.
Don't use for
- Actually scanning code or dependencies — use
/vulnetix:sast-scan, /vulnetix:sca-scan, or /vulnetix:scan.
- Running individual CLI lookups — use
/vulnetix:vuln, /vulnetix:exploits, etc.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
This skill re-runs the capability probe and updates .vulnetix/capabilities.yaml. The file is read by every other Pix skill, hook, command, and agent to scope which Vulnetix CLI subcommands and external integrations (nuclei, snort, yara, semgrep, syft, grype, trivy, cosign, gh, package managers) are meaningful for the user's environment.
The session-start hook normally handles this automatically. Run this skill manually when:
- A new tool was just installed (e.g.
brew install yara) and you want Pix to use it.
- The repo gained a new manifest, Dockerfile, or IaC layout.
- You want to inspect what Pix currently believes about your environment.
Workflow
Step 1: Force a refresh
VULNETIX_FORCE_DETECT=1 bash "${CLAUDE_PLUGIN_ROOT}/hooks/capabilities-detect.sh" --announce
