菜单
Find the newest version of a package that is free of known vulnerabilities, capped by a `--max-major-bump` policy. Use when picking an upgrade target for a vulnerable dep, evaluating major-version churn risk, generating a "safe pin" for a lockfile, or building an `overrides` block.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Self-serve a free Vulnetix VDB API key — install the CLI if missing, then register an email at the public Community endpoint and store the credentials. Use when a user has no API key, hits unauthenticated rate limits, sees auth_status=unauthenticated, or asks to sign up / get a free key. The VDB also works unauthenticated on a shared pool; a free key raises limits.
MITRE ATT&CK technique mapping for a CVE or every entry in `.vulnetix/memory.yaml`. Use when planning detection coverage gaps, mapping a CVE to defender controls, building an executive heatmap of repo risk by tactic, or correlating with internal D3FEND counter-techniques.
Detect installed security binaries (nuclei, snort, yara, semgrep, syft, grype, trivy, cosign, gh, package managers) and repo signals (manifests, Dockerfiles, IaC, CI configs); write .vulnetix/capabilities.yaml. Use when starting a session, after installing a new tool (brew install yara), when other Pix skills emit "unknown capability" notes, or to force-refresh stale capability state.
Unified pre-merge security review — SAST + SCA + secrets + container + IaC + license against the PR diff, dependency-add gate for new direct deps, optional `gh pr review` posting. Use when conducting a comprehensive security review of a feature branch, gating a merge on critical findings, or producing a structured review comment for the PR.
Build a compliance bundle — CycloneDX SBOM, SPDX license report, SARIF findings, OpenVEX/CycloneDX VEX, optional cosign signatures, manifest.json with SHA-256 sums, Markdown index. Use when assembling an audit bundle, SOC 2 attestation, supply-chain compliance package, or evidence for a customer security questionnaire.
Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs.
| name | safe-version |
| description | Find the newest version of a package that is free of known vulnerabilities, capped by a `--max-major-bump` policy. Use when picking an upgrade target for a vulnerable dep, evaluating major-version churn risk, generating a "safe pin" for a lockfile, or building an `overrides` block. |
| argument-hint | <package-name> [--ecosystem npm|pypi|...] [--max-major-bump 1] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep |
| model | sonnet |
| triggers | ["safe version","newest safe","latest safe","upgrade target"] |
| chain | ["fix","dep-resolve"] |
| outputBudget | short |
| cooldown | per-session |
--max-major-bump 1 keeps you near the current major.vulnetix vdb versions <package>./vulnetix:fix or /vulnetix:dep-resolve./vulnetix:vuln.This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Default --ecosystem from derived.primary_package_manager.
vulnetix vdb versions "$PACKAGE" --ecosystem "$ECO" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/versions.jq"
vulnetix vdb vulns "$PACKAGE" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/vulns.jq"
vulnetix vdb purl "pkg:${ECO}/${PACKAGE}@latest" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/purl.jq"
For each version in the version list:
--max-major-bump cap (default 1) to limit churnPick the newest safe version that doesn't exceed the major-bump cap.
Safe version of <package> (<ecosystem>):
Currently installed: <ver>
Latest published: <ver>
Recommended safe: <ver> (skipping vulnerable: 4.16.0–4.17.2 affected by CVE-…)
Major-bump cap: <n>
Suggest /vulnetix:fix or /vulnetix:dep-resolve to apply the bump.
Read-only.
--max-major-bump defaults to 1; pass 0 to stay within the current major (patch + minor only).-beta, -rc); pass --include-prerelease to include them.vdb versions <package> returns versions across ALL ecosystems for the same package name — filter by --ecosystem to scope.ecosystem: "" (empty) for CVE-affected versions that do not map cleanly to a registry — ignore those for safe-version selection.