disclosure-tracker

Scan draft vulnerability advisories and classify them by age and severity.

Updated Jun 2, 2026

Search Tags:#automation #security #vulnerability #compliance #memory #disclosure-tracker

Ready to run

npx skills add https://github.com/Atrium-Hermes/atrium-lighthouse --skill disclosure-tracker-atrium-hermes

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: disclosure-tracker
Source: https://github.com/Atrium-Hermes/atrium-lighthouse/tree/main/skills/disclosure-tracker
Command: npx skills add https://github.com/Atrium-Hermes/atrium-lighthouse --skill disclosure-tracker-atrium-hermes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill audits and surfaces aging vulnerability disclosure drafts from memory/pending-disclosures/, ensuring critical issues are visible each day and escalated when thresholds are exceeded.

Core Features & Use Cases

Daily queue scan: reads memory/pending-disclosures/ to identify draft advisories.
Smart classification: parses YAML frontmatter or content to extract repo, severity, status, and title, and computes age to categorize as escalate, pending, operator-todo, or cleanup.
Cross-reference & escalation: checks memory/topics/pr-status.md for linked PRs to determine coverage, then generates summaries and alerts to security teams.
Observability & memory updates: logs results to memory and prepares notification content for daily briefs.

Quick Start

Run the tracker daily to read memory/pending-disclosures/, classify drafts, and generate the observability notice.

Frequently Asked Questions about disclosure-tracker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate vulnerability disclosure monitoring for pending draft advisories?▼

Automating vulnerability disclosure monitoring involves scanning pending advisories, parsing frontmatter for severity and status, computing age, and classifying drafts into escalate, pending, or cleanup categories. This Skill generates daily digests and escalation notifications for security teams.

What is the best way to track aging vulnerability disclosures and escalate critical issues?▼

Tracking aging vulnerability disclosures requires reading draft advisories from memory, computing their age, and cross-checking linked PRs in status logs. The best approach classifies advisories by severity and age thresholds to trigger automated escalation alerts and daily summaries.

How do I classify draft vulnerability advisories by severity and age for compliance reporting?▼

Classifying draft vulnerability advisories requires parsing YAML frontmatter or content to extract repo, severity, status, and title. By computing advisory age, you can categorize drafts into escalate, pending, operator-todo, or cleanup states for compliance visibility.

Can I cross-reference pending vulnerability disclosures with linked pull requests for coverage tracking?▼

Cross-referencing pending disclosures with pull requests involves checking memory topics and PR status logs for linked entries. This Skill automates that cross-check to determine PR coverage for each advisory, ensuring drafts with open PRs are tracked and reported accurately.

Does the disclosure tracker require YAML frontmatter in draft advisories to extract severity and status?▼

The disclosure tracker parses YAML frontmatter or content directly to extract repo, severity, status, and title fields. If frontmatter is missing, it falls back to parsing content, ensuring draft advisories are classified and aged even without structured metadata.

When should I escalate a pending vulnerability disclosure draft instead of leaving it in the queue?▼

Escalating pending vulnerability disclosure drafts depends on computed age and severity thresholds. Drafts exceeding defined age limits are classified as escalate, triggering daily notification alerts to security teams, while newer or resolved items remain pending or move to cleanup.