wp user list-roles <user> returns both the capabilities that a user has been directly assigned, and the capabilities that they inherit from their role.
Their doesn't appear to be a way to retrieve only a list of the user's direct capabilities. It would be nice to have this option via a flag.