End-of-life detection for runtimes (Node, Python, Java, Go, .NET) and key packages — surfaces past-EOL items, items reaching EOL within 90 days, and EOL base images for containers. Use when planning a runtime upgrade, auditing for unsupported versions, gating a deploy against EOL deps, or producing a remediation roadmap.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
vulnetix scan --sca or repo-impact.license-check.Follows skills/_lib/contract.md. In short: use the vulnetix_* MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes.
Read .vulnetix/capabilities.yaml. Use derived.primary_package_manager and repo.dockerfile to decide which surfaces to scan.
vulnetix scan --block-eol -o json
Exit code is non-zero on EOL hits. Capture findings.
For each detected runtime, fetch authoritative dates:
vulnetix vdb product "<runtime>" -o json # node, python, java, golang, dotnet
| Runtime / package | Installed | EOL date | Days past EOL | Action |
| Node.js | 16.x | 2023-09-11 | 600 | upgrade to 20 LTS |
If --strict, also flag versions reaching EOL within 90 days.
event: eol-check with EOL items per vuln entry (or a top-level runtimes block in memory.yaml if entries don't exist).
vulnetix scan --block-eol exits non-zero on EOL hits — wrap with || true to capture without aborting.vulnetix vdb product — authoritative for major runtimes, less complete for niche libraries.--strict mode flags items reaching EOL within 90 days. Default mode only flags past-EOL.--image registry tag without one.dependency-choice for the recommended target.No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs.
The English summary is being prepared. Showing the original description.
Show what this repository has already decided about its vulnerabilities, read from the durable record rather than by scanning again — open versus resolved, the decision taken on each, and what is still waiting. Use when picking up triage after a break, auditing past decisions, onboarding to a repository with security history, or checking nothing high-severity is open before a release.
The English summary is being prepared. Showing the original description.
Dependency-conflict resolution when a `fix` version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (`overrides`/`resolutions`/`replace`/`[patch]`), fall back to safe-harbour inline patching. Use when an upgrade is blocked by transitive constraints, a peer-dep conflict surfaces, or you need to override a vulnerable transitive without bumping the parent.
The English summary is being prepared. Showing the original description.
Work through which package to add for a capability, and what each option costs — maintenance, licence, bundle weight, transitive risk, and whether the platform already does it. Use when someone needs a library for a job and has not picked one yet, when weighing two candidates, or when a package looks convenient but unmaintained.
The English summary is being prepared. Showing the original description.
IDS/IPS detection content for a CVE — Snort/Suricata-compatible rules, YARA signatures, ProjectDiscovery Nuclei templates, traffic-filter rules. Capability-aware: skips families when the binary is not installed (no Snort = no Snort output). Use when deploying defences for a CVE without a patch, augmenting SAST with active detection, or feeding the SOC engineering pipeline.
The English summary is being prepared. Showing the original description.
Generate a runnable exploit-validation command (Nuclei template, Metasploit module hint, AI-assisted Python script, or curl-based PoC) against a user-specified authorised target. Use when validating that a fix actually closed the vulnerability path, confirming a patch deployed correctly, or producing a copy-pasteable test command for QA. The skill never executes — the user runs.
The English summary is being prepared. Showing the original description.