skills.rest
apache
apacheOFFICIAL
Explore all skills by this author →
WebsiteGitHub

deduplicate-security-issue

Merge duplicate security issue trackers while preserving credits and references.

79|76|Updated Apr 28, 2026
Search Tags:#merge#credits#cve#audit-trail#dedupe#tracker#security-issues
One-click install
npx skills add https://github.com/apache/airflow-steward --skill deduplicate-security-issue
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deduplicate-security-issue
Source: https://github.com/apache/airflow-steward/tree/main/.claude/skills/deduplicate-security-issue
Command: npx skills add https://github.com/apache/airflow-steward --skill deduplicate-security-issue

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Consolidates two trackers describing the same root-cause vulnerability into a single tracker, preserving every reporter's credit, every mailing-list reference, and every independent attack-vector description. The kept tracker updates its body, closes the duplicate with the label "duplicate", and regenerates the CVE JSON attachment so both finders land in credits[].

Core Features & Use Cases

  • Preserve credits and references across merged trackers to maintain audit trails.
  • Enforce scope-safety by preventing merges across different scope labels.
  • Regenerate the CVE JSON attachment on the kept tracker to reflect the merged content.
  • Provide a proposal-based workflow with explicit user confirmation before applying changes.

Quick Start

Merge two trackers by running the skill with the keep and drop tracker numbers; for example, dedupe #123 #456, preserving reporter credits, references, and regenerating the CVE JSON.

Frequently Asked Questions about deduplicate-security-issue

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I merge duplicate security issue trackers without losing reporter credits?▼

You can merge duplicate security trackers by consolidating them into a single kept tracker, which preserves all reporters' credits, mailing-list references, and attack vectors while closing the duplicate issue.

Can I merge security trackers that have different scope labels?▼

No, you cannot merge security trackers across different scope labels. The deduplication process enforces scope-safety by strictly preventing merges between trackers that do not share the same scope boundaries.

What happens to the CVE JSON attachment when I deduplicate security issues?▼

When deduplicating security issues, the CVE JSON attachment on the kept tracker is regenerated to reflect the merged content, ensuring both finders are accurately listed in the credits array.

What tooling is required to consolidate duplicate CVE trackers?▼

Consolidating duplicate CVE trackers requires correct GitHub and uv tooling to execute the merge workflow, regenerate the CVE JSON attachment, and apply the duplicate label to the closed tracker.

Does the security issue deduplication workflow require manual confirmation before closing a tracker?▼

Yes, the security issue deduplication workflow uses a proposal-based approach that requires explicit user confirmation before applying any changes or closing the duplicate tracker.

Related Skills

Explore More Software Engineering Skills→
samuel-morrisseysamuel-morrissey

setup-matt-pocock-skills

Configure repository issue trackers, triage labels, and domain doc layout.

Community
Advanced
monomono
5.5k

security-audit

Audit SkiaSharp native dependencies for CVEs and generate a Security Audit Report.

Official
Advanced
inbharataiinbharatai
22

threat-modeler

Perform STRIDE analysis and generate attack trees for software systems.

Community
Advanced
apacheapache
79

magpie-security-issue-deduplicate

Merge duplicate security issues while preserving credits and details.

Official
Advanced