skills.rest
patriksimek
patriksimekCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

maintainer

Triages, deduplicates, and manages GitHub Security Advisories for the vm2 repository.

4.1k|330|Updated Jan 14, 2014
Search Tags:#vulnerability management#deduplication#triage#security advisories#gitHub#maintainer#vm2
One-click install
npx skills add https://github.com/patriksimek/vm2 --skill maintainer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: maintainer
Source: https://github.com/patriksimek/vm2/tree/main/.claude/skills/maintainer
Command: npx skills add https://github.com/patriksimek/vm2 --skill maintainer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Maintaining a security-critical open-source project like vm2 means handling a continuous stream of GitHub Security Advisory reports, and without a disciplined process reports pile up unacknowledged, duplicates get patched twice, reporters lose credit, and embargoed details risk leaking into public git history.

Core Features & Use Cases

  • Advisory triage and scope decisions: Sweeps the open advisory queue, applies a documented in-scope/out-of-scope test based on whether a documented defense fails its promise, and escalates grey-zone reports to the owner.
  • Clustering and deduplication: Groups reports by root cause using the same-fix test (one patch closing both PoCs at the same chokepoint), assigns primary ownership by creation date, and preserves reporter credit across merged duplicates.
  • Reporter correspondence and ledger tracking: Posts acceptance, closure rationales, and fix summaries to advisory threads, and records every decision in a gitignored ledger so state survives across sessions.
  • Use Case: At the start of a maintenance session, ask the assistant to work the security queue: it sweeps open advisories via the GitHub API, confirms clusters by reading threads, accepts or closes reports with rationales, delegates patching to the fix-vulnerability skill, and hands off confirmed fixes for merge and publication.

Quick Start

Ask the assistant to triage the current vm2 security advisory queue and report which reports are duplicates, which need fixes, and which should be escalated.

Frequently Asked Questions about maintainer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage GitHub Security Advisories for a repository?▼

List open advisories with the GitHub CLI security-advisories API, group them by suspected root cause from titles and summaries, then read full threads only within candidate clusters. Accept in-scope reports promptly and post a written rationale before closing any report.

How do I decide if two vulnerability reports are duplicates?▼

Apply the same-fix test: two reports are duplicates only if one patch closes both proof-of-concepts at the same code chokepoint. Same attack category is not enough; different mechanisms requiring different code changes stay as separate advisories.

Why does a GitHub advisory fork return a 404 error?▼

A 404 on a private advisory fork almost always means the repository invitation has not been accepted yet, not a permissions or scope problem. List pending invitations with the user/repository_invitations API endpoint and accept them before accessing the fork.

What actions should an automated maintainer never perform on advisories?▼

It should never publish advisories, push to the origin remote, merge private forks into main without explicit owner instruction, or place embargoed content like GHSA IDs and reporter names into public git history. These actions stay with the repository owner.

How are reporters credited when duplicate advisories are merged?▼

The primary reporter keeps credit on their own advisory, and duplicate reporters receive reporter credit on the primary advisory they were merged into. Credit does not grant collaborator access, so the primary reporter's thread and PoC remain private.

Related Skills

Explore More Software Engineering Skills→
superagent-aisuperagent-ai
76

security-disclosure-triage

Evaluate security advisories against repository checkouts and assign severity.

Official
Advanced
khoabdkhoabd

deal-with-security-advisory

Coordinate confidential GitHub Security Advisory responses and synchronized patch releases.

Community
Advanced
ElbertePlinioElbertePlinio

vulnerability-validation

Validate code scan findings and generate structured JSON with exploitability details.

Community
Intermediate
enunoenuno

Vuln Scanner

Scan GitHub repositories for security vulnerabilities and automate responsible disclosure.

Community
Advanced