From 916af24a19d9684c9dc83cb0673adfa4015070d8 Mon Sep 17 00:00:00 2001
From: bearsyankees <bearsyankees@gmail.com>
Date: Fri, 28 Aug 2026 09:46:15 -0400
Subject: [PATCH] Correct cloud vulnerability status guidance

---
 skills/managed-pentesting-with-strix/SKILL.md | 2 +-
 strix/interface/cloud/spec.py                 | 8 +++++++-
 tests/test_cloud_cli.py                       | 8 ++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/skills/managed-pentesting-with-strix/SKILL.md b/skills/managed-pentesting-with-strix/SKILL.md
index cc1f5411..9a6e7d76 100644
--- a/skills/managed-pentesting-with-strix/SKILL.md
+++ b/skills/managed-pentesting-with-strix/SKILL.md
@@ -260,7 +260,7 @@ strix cloud scans get <scan-id> --json \
        | .[] | {title, severity, endpoint, cwe}'
 ```
 
-Cloud severities are `critical | high | medium | low` and statuses are `open | in_progress | fixed | ignored`. Sort by an explicit severity order rather than `sort_by(.severity)`, which sorts alphabetically (critical, high, low, medium).
+Cloud severities are `critical | high | medium | low` and statuses are `open | in_progress | snoozed | fixed | ignored | not_affected`. Sort by an explicit severity order rather than `sort_by(.severity)`, which sorts alphabetically (critical, high, low, medium).
 
 Org-wide triage across scans: `strix cloud vulns list --severity critical` (`vulnerabilities:read`, and it also filters by `--status`, `--scan-id`, and more). Update triage state with `strix cloud vulns update <id> --status fixed`. To remediate, hand off to the **fix-security-vulnerabilities-with-strix** skill.
 
diff --git a/strix/interface/cloud/spec.py b/strix/interface/cloud/spec.py
index ab2235a1..22ff0f78 100644
--- a/strix/interface/cloud/spec.py
+++ b/strix/interface/cloud/spec.py
@@ -296,7 +296,13 @@ SPEC: dict[str, dict[str, Cmd]] = {
             "/vulnerabilities/{vulnerabilityId}",
             "Update the status or severity of a vulnerability.",
             body=(
-                P("status", help="New status, for example triaged or false_positive."),
+                P(
+                    "status",
+                    help=(
+                        "New status: open, in_progress, snoozed, fixed, ignored, or "
+                        "not_affected."
+                    ),
+                ),
                 P("note", help="Note that explains the change."),
                 P("severity", help="New severity."),
                 P("severity_reason", help="Reason for the severity change."),
diff --git a/tests/test_cloud_cli.py b/tests/test_cloud_cli.py
index 5877ff1d..4073353d 100644
--- a/tests/test_cloud_cli.py
+++ b/tests/test_cloud_cli.py
@@ -1264,6 +1264,14 @@ def test_corrected_help_distinguishes_inboxes_reports_and_self_hosted_commands()
         assert "magic_link" in parameters["mfa_method"]
         assert " or email." not in parameters["mfa_method"]
 
+    vulnerability_update = {
+        param.name: param.help for param in SPEC["vulns"]["update"].body
+    }
+    assert "in_progress" in vulnerability_update["status"]
+    assert "not_affected" in vulnerability_update["status"]
+    assert "triaged" not in vulnerability_update["status"]
+    assert "false_positive" not in vulnerability_update["status"]
+
     report = {param.name: param.help for param in SPEC["scans"]["report"].query}
     assert "Report content" in report["format"]
     assert "file type" in report["type"]