attack-mapping

# Vulnetix ATT&CK Mapping Skill ## Use when - You need to know which ATT&CK techniques a CVE enables (Initial Access? Execution? Persistence?). - Building an executive heatmap: which tactics dominate this repo's risk profile. - Mapping current detection coverage gaps via ATT&CK → D3FEND. - Correlating multiple CVEs to a shared technique chain (e.g. T1190 + T1059). - Producing input for a purple-team exercise. ## Don't use for - Generating detection rules for the IDS — use `/vulnetix:detection-rules`. - Single-CVE deep-dive — use `/vulnetix:exploits`. - IOC pivots — use `/vulnetix:ioc-pivot`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Produces an ATT&CK technique view of repo risk. Run with a single vuln-id for a focused mapping, or `--all-tracked` to roll up every entry in `.vulnetix/memory.yaml`. ## Step 1: Decide mode If `$ARGUMENTS` matches a vuln-id pattern → single mode. Else if it contains `--all-tracked` → roll-up mode reading every `vulnerabilities.*` entry in `.vulnetix/memory.yaml` (skip those with status `not_affected` or `fixed`). ## Step 2: Fetch ATT&...