skills.rest
Joaoha
JoaohaCOMMUNITY
Explore all skills by this author →
GitHub

deal-with-security-advisory

Automate GitHub Security Advisory workflows from report acknowledgment to synchronized publication.

Updated Aug 27, 2026
Search Tags:#github#governance#coordination#cve#security-advisory#private-fork
One-click install
npx skills add https://github.com/Joaoha/xenon-maas --skill deal-with-security-advisory-joaoha
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deal-with-security-advisory
Source: https://github.com/Joaoha/xenon-maas/tree/main/.agents/skills/deal-with-security-advisory
Command: npx skills add https://github.com/Joaoha/xenon-maas --skill deal-with-security-advisory-joaoha

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Handle a GitHub Security Advisory response for XenonMAAS, including confidential fix development in a temporary private fork, human coordination on advisory-thread comments, CVE request, synchronized advisory publication, and immediate security release steps.

Core Features & Use Cases

  • Acknowledge the report via written templates and human-in-the-loop approvals where needed.
  • Create and manage a temporary private fork for patch development without touching the public repo.
  • Coordinate with reporters and internal stakeholders to publish a coordinated advisory.
  • Request and attach a CVE as part of the disclosure workflow.
  • Synchronize publication across advisory, fork merge, and release as zero-window patch.

Quick Start

Coordinate the security advisory workflow from report to patch, private fork, CVE request, and published release.

Frequently Asked Questions about deal-with-security-advisory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage a GitHub security advisory without leaking vulnerability details before publication?▼

You can securely handle a GitHub security advisory by developing patches in a temporary private fork, coordinating human approvals on advisory threads, and validating steps to prevent public leakage prior to publication.

How does a temporary private fork work for confidential vulnerability patch development?▼

A temporary private fork isolates patch development from the public repository, allowing internal stakeholders to collaboratively fix the security issue without exposing the vulnerability to the broader codebase.

What is the best way to request and attach a CVE during a coordinated security disclosure?▼

The best way to attach a CVE is to integrate the request directly within the GitHub Security Advisory workflow, ensuring the identifier is assigned and linked before the final synchronized release publication.

How do I coordinate human reviewers and reporters during a GitHub security advisory workflow?▼

You can coordinate human reviewers and reporters by using written acknowledgment templates and managing confidential discussions directly on the GitHub advisory thread comments for transparent, tracked communication.

Can I synchronize the publication of a security advisory with a zero-window patch release?▼

Yes, you can synchronize publication across the advisory, private fork merge, and final release to achieve a zero-window patch deployment, ensuring the fix is available the moment the vulnerability is disclosed.

Do I need GitHub API access to automate the end-to-end security advisory workflow?▼

Yes, automating the end-to-end security advisory workflow requires careful access to the GitHub API to manage private forks, coordinate human-in-the-loop approvals, and synchronize publication without public leakage.

Related Skills

Explore More Legal & Compliance Skills→
VitorRibeiro45VitorRibeiro45

deal-with-security-advisory

Coordinate confidential security advisory responses with private forks and patch workflows.

Community
Advanced
peteski22peteski22
22

star-chamber

Coordinate multi-LLM advisory reviews of code and architecture across providers.

Community
Advanced
theandyalvarez7-rubytheandyalvarez7-ruby

senior-secops

Scan code, dependencies, and configurations for vulnerabilities and compliance issues.

Community
Advanced
zebbernzebbern
5

cve-advisory

Generate CVE-format security advisories compliant with CNA rules.

Community
Advanced