threat-feed

# Vulnetix Threat Feed Skill ## Use when - Producing a weekly threat-intel digest for the team. - Scanning for novel AI-discovered vulnerabilities since last week. - Monitoring a specific vendor (`--vendor microsoft`) for rising CVE counts. - Tracking AI-authored malware families relevant to your stack. - Spotting in-the-wild exploitation observations from the AI corpus. ## Don't use for - Single-CVE deep-dive — use `/vulnetix:vuln` or `/vulnetix:exploits`. - Repo-specific intersection — use `/vulnetix:soc-triage` or `/vulnetix:kev-watch`. - Detection rule generation — use `/vulnetix:detection-rules`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Compact daily digest — five concurrent VDB calls merged into one report. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Use `derived.primary_package_manager` to choose default `--ecosystem` if not provided. ## Step 2: Fetch in parallel ```bash vulnetix vdb ai-discoveries -o json --limit 20 | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/ai-list.jq" vulnetix vdb ai-in-wild -o json --limit 20 | jq -f "${CLAUDE...