enclawed-ghsa-maintainer

Inspect, patch, validate, and publish GitHub Security Advisories for Enclawed repositories.

2|Updated May 23, 2026
One-click install
npx skills add https://github.com/enclawed/enclawed-oss --skill enclawed-ghsa-maintainer
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: enclawed-ghsa-maintainer
Source: https://github.com/enclawed/enclawed-oss/tree/main/.agents/skills/enclawed-ghsa-maintainer
Command: npx skills add https://github.com/enclawed/enclawed-oss --skill enclawed-ghsa-maintainer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill streamlines the full GitHub Security Advisory workflow for Enclawed repositories, helping maintainers inspect advisory state, prepare safe updates, and publish fixes without breaking GHSA API constraints.

Core Features & Use Cases

  • Advisory Inspection: Review the current GHSA record and confirm the linked private fork state before making changes.
  • Safe Payload Preparation: Build Markdown and JSON advisory updates carefully to avoid malformed descriptions and patching errors.
  • Publish Guardrails: Verify that private-fork pull requests are closed, apply fields in the correct sequence, and confirm the advisory is published successfully.
  • Use Case: A maintainer needs to update a vulnerability advisory, ensure the private fork is clean, and publish the final record with confidence.

Quick Start

Ask the assistant to inspect the advisory, verify the private fork is clear, prepare the GHSA update safely, and confirm the publish result.

Frequently Asked Questions about enclawed-ghsa-maintainer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I publish a GitHub Security Advisory without breaking the GHSA API constraints?

To publish a GitHub Security Advisory safely, you inspect the current GHSA record, verify the private fork state, apply fields in the correct PATCH sequence, and confirm the published result. This workflow prevents malformed descriptions and patching errors during GHSA publication.

How do I check the state of a private fork before patching a GitHub Security Advisory?

Checking a private fork state before patching a GitHub Security Advisory involves inspecting the advisory record and confirming that linked private-fork pull requests are closed. This verification ensures a clean environment for safe GitHub CLI and jq workflows.

Can I use GitHub CLI and jq to draft Markdown and JSON payloads for GHSA updates?

Yes, you can use GitHub CLI and jq to draft Markdown and JSON payloads for GHSA updates. Building these payloads carefully ensures correct description formatting and prevents patching errors when applying advisory updates via the API.

What is the correct patch sequence for updating GitHub Security Advisories?

The correct patch sequence for updating GitHub Security Advisories requires verifying private-fork pull requests are closed, applying fields in the correct order, and confirming successful publication. This method validates published state, timestamps, and description formatting.

Why does my GitHub Security Advisory publication fail with malformed descriptions?

GitHub Security Advisory publication fails with malformed descriptions when Markdown or JSON payloads are drafted incorrectly. Safe payload preparation requires careful formatting to avoid patching errors and confirm successful publication of the advisory record.

Do I need to verify private-fork pull requests are closed before publishing a GHSA record?

Yes, you need to verify private-fork pull requests are closed before publishing a GHSA record. This publish guardrail ensures safe GitHub CLI workflows, correct PATCH sequencing, and successful confirmation of the advisory's published state and timestamps.