skills.rest
adamtpang
adamtpangCOMMUNITY
Explore all skills by this author →
Website𝕏@adamtpangGitHub

deal-with-security-advisory

Coordinate confidential GitHub Security Advisory triage, private-fork fixes, CVE requests, and security releases.

Updated Jun 16, 2026
Search Tags:#vulnerability#github#gh cli#cve#security advisory#security release#private fork
One-click install
npx skills add https://github.com/adamtpang/summon.company --skill deal-with-security-advisory-adamtpang
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deal-with-security-advisory
Source: https://github.com/adamtpang/summon.company/tree/main/.agents/skills/deal-with-security-advisory
Command: npx skills add https://github.com/adamtpang/summon.company --skill deal-with-security-advisory-adamtpang

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Responding to a reported security vulnerability requires a strict, confidential workflow: one leaked commit message or mistimed publication can expose users to active exploitation. This Skill guides the full GitHub Security Advisory response process so fixes ship safely with zero window between disclosure and patch availability. ## Core Features & Use Cases - Confidential Advisory Triage: Fetches advisory details via the GitHub API and enforces secrecy rules for branches, commits, and public channels. - Private Fork Fix Development: Creates the temporary private fork, develops and locally validates the patch, and coordinates reporter review. - CVE and Synchronized Publication: Requests a CVE, credits the reporter, publishes the advisory, merges the fix, and cuts an immediate security release. - Use Case: A researcher reports a remote code execution vulnerability via GHSA. Use this Skill to build the fix in a private fork, request a CVE, publish the advisory, and release the patched version simultaneously. ## Quick Start Handle the GitHub Security Advisory GHSA-x8hx-rhr2-9rf7 for the Paperclip repository, including the private-fork fix, CVE request, and security release.

Frequently Asked Questions about deal-with-security-advisory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I respond to a GitHub Security Advisory report?▼

Fetch the advisory with the GitHub API, create a temporary private fork for the fix, validate the patch locally, request a CVE, then publish the advisory and release simultaneously. Keep all details confidential until publication.

How do I request a CVE for a GitHub Security Advisory?▼

Send a POST request to the advisory's /cve endpoint using the GitHub API or gh CLI. GitHub acts as a CVE Numbering Authority and assigns one automatically, though it may take a few hours to propagate after publication.

Why doesn't CI run on a GitHub security advisory private fork?▼

GitHub intentionally disables Actions on temporary private forks created from security advisories. You must run all tests locally before pushing the fix to ensure the patch works.

Can I push a security fix to a public branch before publishing the advisory?▼

No. All fix development must stay in the temporary private fork with generic branch and commit names. Pushing to public branches or using descriptive names leaks vulnerability details to attackers before users can upgrade.

What steps require a human when handling a security advisory?▼

Posting comments on the advisory thread requires a human because the thread has no comment API. This includes acknowledging the report, notifying the reporter the fix is ready, and confirming publication.

Related Skills

Explore More Software Engineering Skills→
superagent-aisuperagent-ai
76

security-disclosure-triage

Evaluate security advisories against repository checkouts and assign severity.

Official
Advanced
vecearvecear

dependency-vulnerability-triage

Convert npm audit and Snyk reports into prioritized patch plans.

Community
Advanced
ArabelaTsoArabelaTso
142

time-aware-dependency-cve-scanner

Scan repository dependencies for CVEs disclosed after a specified cutoff date.

Community
Intermediate
kaminocorpkaminocorp
1

Scope Assessment

Verifies a target repository is in-scope for its bug bounty program before analysis.

Official
Intermediate