capabilities-detect

# Vulnetix Capabilities Detector ## Use when - A session just started and `.vulnetix/capabilities.yaml` does not exist or is older than 24h. - A new security tool was just installed (`brew install yara`, `pip install semgrep`) and you want subsequent Pix calls to pick it up. - The repo gained a new manifest type, Dockerfile, or `*.tf` file and you want downstream skills to scope their behaviour. - You need to inspect what Pix currently believes about the environment before debugging a skill. - A downstream skill reports "unknown capability" or fetches rule families you cannot use. ## Don't use for - Actually scanning code or dependencies — use `/vulnetix:sast-scan`, `/vulnetix:sca-scan`, or `/vulnetix:scan`. - Running individual CLI lookups — use `/vulnetix:vuln`, `/vulnetix:exploits`, etc. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. This skill re-runs the capability probe and updates `.vulnetix/capabilities.yaml`. The file is read by every other Pix skill, hook, command, and agent to scope which Vulnetix CLI subcommands and external integrations (nuclei, snort, yara,...