End-of-life detection for runtimes (Node, Python, Java, Go, .NET) and key packages — surfaces past-EOL items, items reaching EOL within 90 days, and EOL base images for containers. Use when planning a runtime upgrade, auditing for unsupported versions, gating a deploy against EOL deps, or producing a remediation roadmap.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
설치 방법 보기설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
vulnetix scan --sca or repo-impact.license-check.Follows skills/_lib/contract.md. In short: use the vulnetix_* MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes.
Read .vulnetix/capabilities.yaml. Use derived.primary_package_manager and repo.dockerfile to decide which surfaces to scan.
vulnetix scan --block-eol -o json
Exit code is non-zero on EOL hits. Capture findings.
For each detected runtime, fetch authoritative dates:
vulnetix vdb product "<runtime>" -o json # node, python, java, golang, dotnet
| Runtime / package | Installed | EOL date | Days past EOL | Action |
| Node.js | 16.x | 2023-09-11 | 600 | upgrade to 20 LTS |
If --strict, also flag versions reaching EOL within 90 days.
event: eol-check with EOL items per vuln entry (or a top-level runtimes block in memory.yaml if entries don't exist).
vulnetix scan --block-eol exits non-zero on EOL hits — wrap with || true to capture without aborting.vulnetix vdb product — authoritative for major runtimes, less complete for niche libraries.--strict mode flags items reaching EOL within 90 days. Default mode only flags past-EOL.--image registry tag without one.dependency-choice for the recommended target.아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Show what this repository has already decided about its vulnerabilities, read from the durable record rather than by scanning again — open versus resolved, the decision taken on each, and what is still waiting. Use when picking up triage after a break, auditing past decisions, onboarding to a repository with security history, or checking nothing high-severity is open before a release.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Dependency-conflict resolution when a `fix` version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (`overrides`/`resolutions`/`replace`/`[patch]`), fall back to safe-harbour inline patching. Use when an upgrade is blocked by transitive constraints, a peer-dep conflict surfaces, or you need to override a vulnerable transitive without bumping the parent.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Work through which package to add for a capability, and what each option costs — maintenance, licence, bundle weight, transitive risk, and whether the platform already does it. Use when someone needs a library for a job and has not picked one yet, when weighing two candidates, or when a package looks convenient but unmaintained.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
IDS/IPS detection content for a CVE — Snort/Suricata-compatible rules, YARA signatures, ProjectDiscovery Nuclei templates, traffic-filter rules. Capability-aware: skips families when the binary is not installed (no Snort = no Snort output). Use when deploying defences for a CVE without a patch, augmenting SAST with active detection, or feeding the SOC engineering pipeline.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Generate a runnable exploit-validation command (Nuclei template, Metasploit module hint, AI-assisted Python script, or curl-based PoC) against a user-specified authorised target. Use when validating that a fix actually closed the vulnerability path, confirming a patch deployed correctly, or producing a copy-pasteable test command for QA. The skill never executes — the user runs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.