skills.rest
nabitllc
nabitllcOFFICIAL
Explore all skills by this author →
GitHub

deal-with-security-advisory

Coordinates confidential GitHub Security Advisory triage, private-fork fixes, CVE requests, and synchronized security releases.

Updated Mar 26, 2026
Search Tags:#github#gh cli#cve#security advisory#vulnerability response#security release#private fork
One-click install
npx skills add https://github.com/nabitllc/todero --skill deal-with-security-advisory-nabitllc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deal-with-security-advisory
Source: https://github.com/nabitllc/todero/tree/main/.agents/skills/deal-with-security-advisory
Command: npx skills add https://github.com/nabitllc/todero --skill deal-with-security-advisory-nabitllc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Responding to a reported vulnerability requires strict confidentiality, a private development workflow, and perfectly timed publication so attackers get zero window between disclosure and patch availability. This Skill guides the entire GitHub Security Advisory response process for the Todero repository without leaking details publicly. ## Core Features & Use Cases - Confidential advisory handling: Fetches advisory details via the GitHub API and enforces rules against leaking vulnerability information in commits, branches, or public channels. - Private fork fix workflow: Creates a temporary private fork, develops and locally tests the patch (since CI does not run on private forks), and verifies the attack vector is closed. - Coordinated publication: Requests a CVE, credits the reporter, publishes the advisory, merges the fix, and cuts a security release simultaneously. - Use Case: A researcher reports a remote code execution vulnerability via GHSA. Use this Skill to acknowledge the reporter, patch the issue in a private fork, request a CVE, and publish the advisory and release in one coordinated step. ## Quick Start Handle the security advisory GHSA-x8hx-rhr2-9rf7 reported by a researcher, develop the fix in a private fork, and publish the advisory with a patched release.

Frequently Asked Questions about deal-with-security-advisory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I respond to a GitHub Security Advisory report?▼

Fetch the advisory with the GitHub API, acknowledge the reporter on the private thread, create a temporary private fork for the fix, then publish the advisory and release simultaneously. The Skill walks through each step using gh CLI commands.

How do I request a CVE for a GitHub Security Advisory?▼

Send a POST request to the advisory's /cve endpoint using the GitHub API. GitHub acts as a CVE Numbering Authority and assigns one automatically, though it may take a few hours to propagate after publication.

Why does CI not run on a security advisory private fork?▼

GitHub Actions do not run on temporary private forks by design, which is a GitHub platform limitation. You must run all tests locally in the private fork clone before publishing the fix.

Can I push a security fix to a public branch before publishing?▼

No. All fix development must stay in the temporary private fork until publication. Pushing to public branches, using descriptive branch names, or mentioning details in commit messages leaks the vulnerability to attackers before users can upgrade.

What happens when a GitHub Security Advisory is published?▼

Publishing makes the GHSA public, merges the temporary private fork into the repository, and triggers CVE assignment if one was requested. A patched release should be cut immediately after to minimize the exposure window.

Related Skills

Explore More Software Engineering Skills→
acmacalisteracmacalister

security-review

Parse and classify vulnerability reports with Bugcrowd VRT mapping and remediation steps.

Community
Advanced
oogDZoogDZ

post-release

Validate GitHub Release notes, CHANGELOG updates, and deployment statuses after publication.

Community
Intermediate
bpnrockstarbpnrockstar

hunt-api-misconfig

Detect API security misconfigurations including mass assignment, JWT attacks, and prototype pollution.

Community
Advanced
castrojocastrojo
2

security-embargo

Create security embargo policies and draft pre-disclosure notices for CNCF projects.

Community
Intermediate