deal-with-security-advisory

Coordinate GitHub Security Advisory responses from detection through synchronized public release.

Updated Apr 16, 2026

Search Tags:#github #cve #incident-response #patch-management #security-advisory #private-fork

Ready to run

npx skills add https://github.com/travelinman1013/royclip --skill deal-with-security-advisory-travelinman1013

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: deal-with-security-advisory
Source: https://github.com/travelinman1013/royclip/tree/main/.agents/skills/deal-with-security-advisory
Command: npx skills add https://github.com/travelinman1013/royclip --skill deal-with-security-advisory-travelinman1013

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Coordinated, confidential security incident response for Paperclip that prevents disclosure leaks and streamlines patch development, review, and release.

Core Features & Use Cases

Acknowledge and triage GitHub Security Advisories.
Spin up a private fork for patch development without affecting the public repository.
Coordinate human responses, advisories, and CVE requests with stakeholders.
Publish the advisory and coordinate the release to users in a synchronized timeline.
Post-implementation verification and communications with reporters.

Quick Start

Load the advisory details and initiate a private fork to begin implementing the fix.

Frequently Asked Questions about deal-with-security-advisory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I coordinate a GitHub Security Advisory response without leaking vulnerability details?▼

To coordinate a GitHub Security Advisory response without leaking vulnerability details, use a private fork for patch development. This isolates the fix from the public repository while guiding steps, human approvals, and secure handling.

How does a private fork help with patch management during a security incident?▼

A private fork helps patch management by spinning up a confidential development branch separate from the public repository. This allows stakeholders to develop and review security patches without prematurely exposing vulnerability details.

What's the best way to manage CVE requests and public disclosure timelines for a GitHub vulnerability?▼

The best way to manage CVE requests and public disclosure timelines is to synchronize the advisory publication with the patch release. Coordinate human responses and CVE requests with stakeholders to ensure a synchronized release schedule.

When do I need an incident response workflow for a GitHub Security Advisory?▼

You need an incident response workflow for a GitHub Security Advisory when a vulnerability requires coordinated confidential patching. It handles the end-to-end process from initial detection through advisory publication, release, and reporter communication.

Can I automate security advisory handling while still requiring human approvals?▼

Yes, you can automate security advisory handling while still requiring human approvals. The workflow meets automated requirements by guiding each step, orchestrating secure patch development, and routing stakeholder responses for explicit approval.