Geert Hendrickx wrote:

> I tried setting that in /etc/mk.conf but it didn't have any effect.  Where
> must this variable be defined?

PKGVULNDIR is set in download-vulnerability-list which is a shell
script. The default value is determined at build time of the package.

Either set PKGVULNDIR in your environment or set it in /etc/mk.conf
and rebuild the package audit-packages.

ciao
     Klaus