skills.rest
lukehinds
lukehindsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

disclose

Draft GHSA-style advisory disclosures from scrutineer finding data.

Updated May 20, 2026
Search Tags:#automation#vulnerability#disclosure#finding#ghsa#security-disclosure#scrutineer
One-click install
npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill disclose
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: disclose
Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/disclose
Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill disclose

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Draft GHSA-style disclosures from audit findings by translating finding data into a structured advisory draft. This workflow streamlines turning confirmed findings into maintainer-ready disclosures, including a summary, severity handling, CWEs, CVSS data, and references.

Core Features & Use Cases

  • Generates a GHSA-ready summary, description, vulnerabilities per package, CVSS vector, CWE IDs, and references from the finding data.
  • Writes the draft back to the finding as disclosure_draft and creates per-finding references as needed.
  • Produces a report.json and schema.json to support downstream submission to GitHub's advisory API, and accepts patch/repost cycles during re-runs.

Quick Start

Provide the finding_id in context.json and run the skill to generate a GHSA disclosure draft.

Frequently Asked Questions about disclose

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I draft a GHSA-style security advisory from vulnerability findings?▼

Draft GHSA-style security advisories by loading vulnerability finding data and translating it into a structured advisory draft. The output includes a maintainer-ready summary, severity metrics, CVSS vectors, CWE IDs, and references.

What is the process for converting security audit findings into GitHub advisory drafts?▼

Converting security audit findings into GitHub advisory drafts involves loading finding details via the scrutineer API and writing back a structured disclosure_draft. This process structures the summary, vulnerabilities per package, and references for submission.

How do I generate CVSS vectors and CWE IDs for a vulnerability disclosure?▼

Generate CVSS vectors and CWE IDs for vulnerability disclosures by processing finding data through an automated advisory drafting workflow. The system extracts severity data and weakness identifiers to populate the structured advisory draft.

Can I automate the creation of GitHub security advisories from audit findings?▼

Automate GitHub security advisory creation from audit findings by providing a finding_id in context.json. The workflow fetches details from the scrutineer API, constructs per-package vulnerabilities, and generates report.json and schema.json for downstream submission.

Does this advisory drafting workflow support re-runs and patch cycles?▼

The advisory drafting workflow supports re-runs and patch cycles by accepting repost cycles. It generates report.json and schema.json to support downstream submission to GitHub's advisory API, allowing iterative updates to the disclosure draft.

What do I need to provide to generate a security disclosure draft?▼

Provide a finding_id within a context.json file to generate a security disclosure draft. The workflow relies on scrutineer API endpoints to fetch the finding and repository details required to construct the advisory.

Related Skills

Explore More Legal & Compliance Skills→
lukehindslukehinds

verify

Re-run finding reproductions against repository HEAD and output a verification report.

Community
Advanced
lukehindslukehinds

cna-match

Match GitHub repositories to CVE Numbering Authorities and output report.json.

Community
Advanced
lukehindslukehinds

fork

Fork scanned upstreams into a disclosure org and file draft advisories.

Community
Advanced
majunbaomajunbao

openclaw-ghsa-maintainer

Inspect, patch, validate, publish, and confirm GHSA advisory private-fork state.

Community
Advanced