{
  "$schema": "https://schemas.agentskills.io/discovery/0.2.0/schema.json",
  "skills": [
    {
      "name": "vulngraph-ask",
      "type": "archive",
      "description": "Answer questions about vulnerabilities across a portfolio of services with VulnGraph: how bad it is, what to fix first, how exposed a service is, whether a CVE affects us, where a package is used, which base image a service is built on, how a package reaches a service, what changed and the trend. Use when: (1) someone asks about CVEs, advisories, vulnerable packages or exposure, (2) a manager wants a status or trend, (3) an engineer asks what to fix first or what is blocked, (4) a service, package or CVE name may be misspelled.",
      "url": "vulngraph-ask.tar.gz",
      "digest": "sha256:cf2db00c3c7eabfef58200cdf4b8ed62c822c2188ab783550a6c3261460c557a"
    },
    {
      "name": "vulngraph-connect",
      "type": "archive",
      "description": "Connect an AI agent to VulnGraph: get an API key with the right scopes, add the VulnGraph MCP server to Cursor or Claude Code without putting the key in a config file, fall back to plain HTTP, and verify the connection. Use when: (1) setting up VulnGraph for an agent for the first time, (2) choosing scopes for a key, (3) writing an MCP config for VulnGraph, (4) checking that an agent can reach VulnGraph.",
      "url": "vulngraph-connect.tar.gz",
      "digest": "sha256:d0069fe7ed2a98a9c39e35e5e9301e43f7d3e727aa152f23f7a9c847900e8251"
    },
    {
      "name": "vulngraph-debug",
      "type": "archive",
      "description": "Diagnose problems talking to VulnGraph by symptom: 401 and 403 errors, not-found answers with did_you_mean, 429 rate limits, stale or truncated answers, and MCP connection failures in Cursor, Claude Code or the mcp-remote bridge. Use when: (1) a VulnGraph call fails or returns an error, (2) the MCP server does not show up or shows no tools, (3) answers look old, cut short or wrong, (4) a scan run failed.",
      "url": "vulngraph-debug.tar.gz",
      "digest": "sha256:53edd5cf6a3f97c55b3d7f559e8d8dedaffebf38a4113affb16fac699cc28d71"
    },
    {
      "name": "vulngraph-decide",
      "type": "archive",
      "description": "Resolve VulnGraph Decide steps: read the numbered options for a vulnerable package with no fixed version, choose one with a short recorded reason, say what the decision unblocks, and escalate to a person when the choice is not the agent's to make. Use when: (1) a plan has Decide steps or decide_count is above zero, (2) remediation is blocked on a decision, (3) asked to replace, patch, mitigate or accept the risk of a vulnerable dependency.",
      "url": "vulngraph-decide.tar.gz",
      "digest": "sha256:710a89987490c57af08afc7f24707160200ac767d8b3540136c48ce2f1c81be2"
    },
    {
      "name": "vulngraph-remediate",
      "type": "archive",
      "description": "Work through a VulnGraph remediation plan like a developer would: in waves, at most one pull request per repository, Decide steps treated as blockers, and every step's real status recorded. Use when: (1) asked to fix vulnerabilities from a VulnGraph plan, (2) picking the next step or wave to work on, (3) opening, tracking or closing PRs for plan steps, (4) choosing the minimal severity to fix (MStF).",
      "url": "vulngraph-remediate.tar.gz",
      "digest": "sha256:b6bed9b14b5f5270a87bf21887d7e912ac888ebc9d294aee8929fe181f4b7618"
    }
  ]
}