soc-triage

# Vulnetix SOC Triage Skill ## Use when - Start of a SOC shift: "what landed overnight that hits our deps?". - Building today's P1–P4 action list grouped by package manager. - Filtering for KEV-only or EPSS > 0.5 items intersected with installed packages. - Producing a handoff watchlist for the next shift. - Weekly all-hands prep: top 10 items the team should know about. ## Don't use for - Single-CVE deep-dive — use `/vulnetix:vuln` or `/vulnetix:exploits`. - Cross-CVE exploit search by ecosystem — use `/vulnetix:exploits-search`. - Applying fixes — use `/vulnetix:fix` per item. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. The "daily SOC pull" — fetches Vulnetix's score-driven triage feed, narrows it to ecosystems / packages this repo actually uses (per `.vulnetix/capabilities.yaml`), and produces a ranked action list. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Use `derived.primary_package_manager` and the `repo.*` flags to choose the ecosystem filter. If the file is missing, run `${CLAUDE_PLUGIN_ROOT}/hooks/capabilities-detect.sh` first. ## St...