kev-watch

# Vulnetix KEV Watch Skill ## Use when - You want to know "are any of our deps in CISA KEV right now?". - Monitoring CISA additions since a date (`--since 2026-04-01`). - Producing a deadline-driven action list — items with KEV due dates within 14 days. - Choosing between competing CVEs to patch first based on KEV listing. - Pre-audit: ensuring no KEV items remain open past their due date. ## Don't use for - Per-CVE enrichment — use `/vulnetix:vuln`. - Daily SOC pull — use `/vulnetix:soc-triage` (KEV is one signal among many there). - Single-KEV lookup by CVE — use `vulnetix vdb kev get <id>` directly. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Pulls the KEV catalog and intersects with installed packages — the "what's on fire and is it in my repo?" view. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Use `derived.primary_package_manager` to focus the lockfile scan. ## Step 2: Pull KEV catalog ```bash vulnetix vdb kev list $ARGUMENTS -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/kev.jq" ``` Honor `--since`, `--catalog`. Default `--catalo...