vex-publish

# Vulnetix VEX Publication Skill ## Use when - Triage cycle is complete and you need to publish VEX statements for supply-chain consumers. - A customer requested OpenVEX attestations for a specific delivery. - Attaching VEX to a CycloneDX SBOM in a compliance bundle. - Posting VEX status as a PR comment so reviewers see the security disposition. - Auditing the decision history — VEX is the durable record of what was decided when. ## Don't use for - Making the triage decisions — use `/vulnetix:vuln`, `/vulnetix:exploits`, `/vulnetix:fix` first; this skill publishes existing decisions. - Generating the SBOM itself — use `/vulnetix:sbom-generate`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Turns the decisions captured in `.vulnetix/memory.yaml` into a signed/uploadable VEX document. ## Step 1: Load memory Read `.vulnetix/memory.yaml`. Collect every entry with a non-default `decision.choice` (i.e. anything that isn't `investigating`). ## Step 2: Map decisions → VEX status Mapping (Vulnetix CLI uses the same): - `not-affected` / `risk-avoided` → `not_affected` - `fix-...