detection-rules

# Vulnetix Detection Rules Skill ## Use when - A CVE has no patch yet and you need detection-only mitigation. - Augmenting SAST with active runtime detection (Snort/Suricata). - Feeding the SOC engineering pipeline with rule files. - Building a Nuclei scan template for an authorised target assessment. - Hardening a YARA ruleset against a newly-discovered malware family. ## Don't use for - Executing the rules — this skill writes files; the user runs the engine. - Patching the underlying issue — use `/vulnetix:fix`. - Single-CVE enrichment — use `/vulnetix:vuln`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Pulls IDS/IPS, malware-detection, and active-scan content for a CVE. Capability-aware: only fetches rule families the user can actually use. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Capture `derived.detection_stack`. If empty, prompt: ``` No detection tooling found (snort, suricata, yara, nuclei, semgrep). I can still fetch the raw rules — proceed? ``` If the user accepts, treat the stack as `[snort, yara, nuclei]` for completeness. Otherwi...