skills.rest
triss-smith
triss-smithCOMMUNITY
Explore all skills by this author →
GitHub

deal-with-security-advisory

Automate GitHub Security Advisory responses with private forks, CVE requests, and publication workflows.

Updated Apr 14, 2026
Search Tags:#security#github#coordination#cve#publication#advisories#private-fork
One-click install
npx skills add https://github.com/triss-smith/offwatch --skill deal-with-security-advisory-triss-smith
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deal-with-security-advisory
Source: https://github.com/triss-smith/offwatch/tree/main/.agents/skills/deal-with-security-advisory
Command: npx skills add https://github.com/triss-smith/offwatch --skill deal-with-security-advisory-triss-smith

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Handle confidential GitHub Security Advisory responses by coordinating private fix development, human-thread coordination, CVE requests, and synchronized publication to minimize exposure.

Core Features & Use Cases

  • Private, confidential fork-based fix development without touching the public repo.
  • Coordinated advisory-thread communication with reporters and stakeholders.
  • End-to-end publication workflow including CVE requests and synchronized release steps.

Quick Start

Begin the private advisory workflow for a GHSA, create the temporary private fork, patch, verify, and publish with coordinated communication.

Frequently Asked Questions about deal-with-security-advisory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I coordinate a GitHub security advisory response end-to-end?▼

GitHub security advisory coordination requires managing private forks, interacting within advisory threads, requesting CVEs, and executing synchronized publication steps to maintain confidentiality and release integrity.

How does private fork fix development work for confidential vulnerability disclosure?▼

Private fork fix development allows you to patch vulnerabilities in a temporary, confidential repository without touching the public repo. This isolates the security advisory response until synchronized publication is ready.

Can I request a CVE through the GitHub Security Advisories workflow?▼

Yes, you can request a CVE through the GitHub Security Advisories workflow. The process integrates CVE requests into the end-to-end publication workflow, enabling engineers and security researchers to secure identifiers before disclosure.

What is needed to automate confidential security advisory workflows?▼

Automating confidential security advisory workflows requires GitHub API access, private-fork handling, advisory-thread interactions, and controlled publication steps. These components maintain confidentiality and release integrity throughout the process.

Does this security advisory workflow support stakeholder communication during private fix development?▼

Yes, the security advisory workflow supports coordinated advisory-thread communication. It enables reporters, engineers, and release teams to interact privately during fix development until the synchronized publication phase.

Related Skills

Explore More Software Engineering Skills→
bychrisrbychrisr

deal-with-security-advisory

Manage GitHub Security Advisory response lifecycles with private forks and coordinated disclosure.

Community
Advanced
fmindfmind
1.4k

MLOps Collaboration

Transform private MLOps projects into public resources with governance and release workflows.

Community
Advanced
Agent-Pattern-LabsAgent-Pattern-Labs
4

openclaw-ghsa-maintainer

Automates GHSA security advisory inspection, patching, validation, and publication for OpenClaw.

Official
Intermediate
navyapdh11navyapdh11

deal-with-security-advisory

Coordinate confidential GitHub security advisories through private fix development and synchronized publication.

Community
Advanced