npx skills add davepoon/buildwithclaude --skill vuln --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Vulnetix Vulnerability Lookup Skill This skill serves two purposes based on the argument provided: - **Vuln ID argument** (CVE-*, GHSA-*, PYSEC-*, etc.) --> retrieves detailed vulnerability intelligence and assesses its impact against the current repository - **Package name argument** (express, lodash, log4j-core, etc.) --> lists all known vulnerabilities for that package and identifies which ones affect your installed version **This skill does not modify application code** -- it only updates `.vulnetix/memory.yaml` to track findings. Use `/vulnetix:fix` for remediation, `/vulnetix:exploits` for exploit analysis, or `/vulnetix:remediation` for a context-aware remediation plan. ## Argument Detection Determine the mode from the argument: **Vuln lookup mode** -- argument matches any known vulnerability identifier pattern: - `CVE-*` (e.g., CVE-2021-44228) - `GHSA-*` (e.g., GHSA-jfh8-3a1q-hjz9) - `PYSEC-*`, `GO-*`, `RUSTSEC-*`, `EUVD-*`, `OSV-*`, `GSD-*`, `VDB-*`, `GCVE-*` - `SNYK-*`, `ZDI-*`, `MSCVE-*`, `MSRC-*`, `RHSA-*`, `TALOS-*`, `EDB-*` - `WORDFENCE-*`, `PATCHSTACK-*`, `MFSA*`, `JVNDB-*`, `CNVD-*`, `BDU:*`, `HUNTR-*` - `DSA-*`, `DLA-*`, `USN-*`, `ALSA-*`, `RLSA-*`, `MGASA-*`, `O
- Argument Detection
- Vulnerability Memory (.vulnetix/memory.yaml)
- Schema
- Reading Prior State and SBOMs
- Writing Updated State
- VEX Status Mapping
- Dependabot Integration
- Vuln Lookup Mode Workflow
- Step L1: Load Vulnerability Memory
- Step L2: Fetch Vulnerability Data
- Step L3: Enrich with Metrics
- Step L4: Analyze Repository Impact
- Step L5: Present Structured Summary
- Step L6: Update Vulnerability Memory
gh api repos/{owner}/{repo}/dependabot/alerts?state=open --jq '[.[] | select(.dependency.package.name == "'"$PACKAGE_NAME"'")] | length'
vulnetix vdb vuln "$ARGUMENTS" -o json
vulnetix vdb metrics "$ARGUMENTS" -o json
vulnetix vdb vulns "$ARGUMENTS" -o jsonWhat does the vuln skill do?
Look up a vulnerability by ID or list all vulnerabilities for a package
How do I install it?
Run `npx skills add davepoon/buildwithclaude --skill vuln --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From davepoon/buildwithclaude, a repository with 3,251 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.