{"id":89077,"plugin_id":"plugin_asdk_app_6aea7be482bc8191a19ee6b24968802c","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-11-10T12:10:03.015Z","digest":"d30212df2ca563309e18089f8ead10a9963862940a09e36b030b01a9cbc73901","against":null,"payload":{"description":"Connect a VulKill account, inspect the security catalog and credits, and prepare authorized source-code or live website scans.","included_files":[],"name":"get-started","skill_md_contents":"---\nname: get-started\ndescription: Connect a VulKill account, inspect the security catalog and credits, and prepare authorized source-code or live website scans.\n---\n\n# Getting started with VulKill Security\n\n1. Use the host's VulKill OAuth connection. If sign-in is needed, let the user sign in with an offered identity method and review the requested permissions. For a new member, the site combines membership terms and MCP permission in one explicit consent screen. A website login alone does not install or authorize the host connector. Never request passwords or tokens in chat.\n2. Call `vulkill_ai_guide` for the current workflow, modes, requirements and liability statement. Call `vulkill_capabilities` with `query: \"all\"` when the user asks for all 12 domains and all 260 controls; an empty query returns an overview. Catalog scope is not proof of executed tests.\n3. Call `vulkill_wallet_status` for the connected user's actual credits. Use `vulkill_credit_usage` for the current period's usage. Do not describe the account as a demo or reviewer account unless it actually is one.\n4. Ask which authorized source contents or verified HTTPS target the user wants to scan. A local filesystem path or GitHub repository URL alone does not transfer files. For website ownership verification, follow the guide's target page/API process. Use `vulkill_estimate_scan` for a read-only estimate; it starts no job and charges no credits.\n5. Before calling `vulkill_start_scan`, present the current liability statement and obtain the user's explicit acceptance for the specific scope. Do not accept on their behalf or infer acceptance from signing in. Send actual sourceFiles or a verified targetUrl, the correct authorizationScope, and a stable idempotencyKey. Respect the server's limits and returned errors.\n6. Use `vulkill_get_scan_status` to follow the returned scanId and `vulkill_list_reports` for saved account reports. An accepted request, credit reservation or available engine is not proof of completion. Report only actual findings and coverage; zero findings is valid. Never fabricate results or claim all domains ran.\n7. `search` searches capabilities and the connected account's saved reports. Pass returned IDs to `fetch`; cap- IDs represent catalog entries, while report IDs represent scan reports. Explain which record type was returned. If no report matches, say so.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}