import-security-issue-from-pr

Create a security tracker from a public upstream PR via gh api.

79|76|Updated Apr 28, 2026

Search Tags:#security #cve #project-board #gh-api #tracker #pr-import #upstream-pr

Ready to run

npx skills add https://github.com/apache/airflow-steward --skill import-security-issue-from-pr

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: import-security-issue-from-pr
Source: https://github.com/apache/airflow-steward/tree/main/.claude/skills/import-security-issue-from-pr
Command: npx skills add https://github.com/apache/airflow-steward --skill import-security-issue-from-pr

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Convert a public upstream PR that contains a security-relevant fix into a dedicated tracker in the security project, enabling formal CVE allocation and coordinated disclosure workflows.

Core Features & Use Cases

Detects the PR metadata (title, body, author, state) and derives the applicable scope based on changed files.
Proposes milestone and constructs a complete tracker payload (title, body, labels, and status) before creation.
Creates the tracker in the tracker repository, applies labels, assigns a milestone, pins to the Assessed board, and surfaces a status rollup for hand-off to CVE allocation.
Enforces safety rules for public-PR imports, including reporter credit policy and confidentiality considerations.

Quick Start

Import a public upstream PR (URL or number) to convert it into a security tracker ready for CVE allocation.

Frequently Asked Questions about import-security-issue-from-pr

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I convert a public PR fix into a security tracker for CVE allocation?▼

Importing a public upstream PR creates a dedicated security tracker for CVE tracking. The process validates PR access, derives scope from changed files, proposes milestones, and builds a complete tracker payload with nine fields to enable coordinated disclosure.

How does importing an upstream PR for security tracking work?▼

Importing an upstream PR for security tracking validates PR access, derives scope from changed files, constructs a tracker payload with nine fields, and writes it via gh api. It enforces reporter credit and confidentiality policies during the import process.

Do I need gh api authentication to import a PR into a security project board?▼

Yes, importing a PR into a security project board requires gh api authenticated with access to both the tracker and upstream repos. Project-board permissions are mandatory to create the tracker, apply labels, assign milestones, and pin issues to the Assessed board.

Can I use this PR import tool for fixes affecting multiple scopes like airflow and providers?▼

No, this PR import tool applies only to PRs affecting a single scope like airflow, chart, or providers. It derives the scope directly from changed files to build the tracker payload, so multi-scope PRs fall outside its supported use cases.

What limitations apply when turning public PR fixes into security trackers?▼

Limitations when turning public PR fixes into security trackers include single-scope restrictions and enforced safety rules. The tool mandates reporter credit policies, confidentiality considerations, and gh api authenticated access to both the tracker and upstream repos.