{
  "skills": [
    {
      "name": "vulngraph-ask",
      "description": "Answer questions about vulnerabilities across a portfolio of services with VulnGraph: how bad it is, what to fix first, how exposed a service is, whether a CVE affects us, where a package is used, which base image a service is built on, how a package reaches a service, what changed and the trend. Use when: (1) someone asks about CVEs, advisories, vulnerable packages or exposure, (2) a manager wants a status or trend, (3) an engineer asks what to fix first or what is blocked, (4) a service, package or CVE name may be misspelled.",
      "files": [
        "references/question-map.md",
        "SKILL.md"
      ]
    },
    {
      "name": "vulngraph-connect",
      "description": "Connect an AI agent to VulnGraph: get an API key with the right scopes, add the VulnGraph MCP server to Cursor or Claude Code without putting the key in a config file, fall back to plain HTTP, and verify the connection. Use when: (1) setting up VulnGraph for an agent for the first time, (2) choosing scopes for a key, (3) writing an MCP config for VulnGraph, (4) checking that an agent can reach VulnGraph.",
      "files": [
        "SKILL.md"
      ]
    },
    {
      "name": "vulngraph-debug",
      "description": "Diagnose problems talking to VulnGraph by symptom: 401 and 403 errors, not-found answers with did_you_mean, 429 rate limits, stale or truncated answers, and MCP connection failures in Cursor, Claude Code or the mcp-remote bridge. Use when: (1) a VulnGraph call fails or returns an error, (2) the MCP server does not show up or shows no tools, (3) answers look old, cut short or wrong, (4) a scan run failed.",
      "files": [
        "SKILL.md"
      ]
    },
    {
      "name": "vulngraph-decide",
      "description": "Resolve VulnGraph Decide steps: read the numbered options for a vulnerable package with no fixed version, choose one with a short recorded reason, say what the decision unblocks, and escalate to a person when the choice is not the agent's to make. Use when: (1) a plan has Decide steps or decide_count is above zero, (2) remediation is blocked on a decision, (3) asked to replace, patch, mitigate or accept the risk of a vulnerable dependency.",
      "files": [
        "SKILL.md"
      ]
    },
    {
      "name": "vulngraph-remediate",
      "description": "Work through a VulnGraph remediation plan like a developer would: in waves, at most one pull request per repository, Decide steps treated as blockers, and every step's real status recorded. Use when: (1) asked to fix vulnerabilities from a VulnGraph plan, (2) picking the next step or wave to work on, (3) opening, tracking or closing PRs for plan steps, (4) choosing the minimal severity to fix (MStF).",
      "files": [
        "SKILL.md"
      ]
    }
  ]
}