verify-fix

# Vulnetix Fix Verification Skill ## Use when - You just applied a fix via `/vulnetix:fix` and need PASS/FAIL confirmation. - Validating a peer-dep upgrade chain did not introduce new vulnerabilities. - Producing a clean-scan attestation for a compliance bundle. - Pre-release: confirming all triaged P1/P2 items are resolved. - Setting decision status from `under_investigation` to `fixed` with audit trail. ## Don't use for - Initial scanning — use `/vulnetix:scan` or `/vulnetix:soc-triage`. - Applying the fix — use `/vulnetix:fix` first. - Multi-CVE upgrade verification — use `@dep-upgrade-orchestrator` agent. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Run after `/vulnetix:fix` (or any manual remediation) to confirm the vulnerability is gone and no regressions appeared. ## Step 1: Load capabilities + memory Read `.vulnetix/capabilities.yaml` and `.vulnetix/memory.yaml`. Find the entry for `$ARGUMENTS`. Capture: package, fixed_version, manifest path. ## Step 2: Pre-flight ```bash # Ensure the manifest changed since last scan git diff --name-only HEAD~5 -- "<manifes...