skills.rest
patriksimek
patriksimekCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

merge-fix

Squash-merge confirmed vm2 vulnerability fixes from private GHSA forks into local main.

4.1k|330|Updated Jan 14, 2014
Search Tags:#Git#conflict resolution#GHSA#vm2#security advisory#Merge#vulnerability fix
One-click install
npx skills add https://github.com/patriksimek/vm2 --skill merge-fix
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: merge-fix
Source: https://github.com/patriksimek/vm2/tree/main/.claude/skills/merge-fix
Command: npx skills add https://github.com/patriksimek/vm2 --skill merge-fix

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Landing a confirmed, embargoed vm2 security fix from a private per-advisory fork into local main involves many error-prone manual steps: syncing the fork, resolving conflicts across CHANGELOG, ATTACKS.md, and lib code, scrubbing reporter attribution, and re-running the full multi-version test sweep. This Skill automates that integration while enforcing strict safety rules.

Core Features & Use Cases

  • Deliberate conflict resolution: Handles CHANGELOG entry trimming, ATTACKS.md category renumbering, package.json version bumps, and semantic lib/*.js merges with diff3 context.
  • Attribution scrubbing: Removes reporter names, handles, embargo dates, and acknowledgements from commits, comments, and docs before landing.
  • Advisory metadata audit: Checks GHSA fields (CVSS vector, CWE, version ranges) via the GitHub API and proposes concrete values for missing items.
  • Full test verification: Re-runs the test suite across Node versions 8 through 26 plus the advisory's own repro before reporting.
  • Use Case: After a reporter confirms a sandbox escape fix on the private fork, invoke with the GHSA ID to land it as a single squashed commit on local main without ever pushing to origin.

Quick Start

Merge the confirmed fix for GHSA-9g8x-92q2-p28f into local main and run the full test sweep.

Frequently Asked Questions about merge-fix

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I merge a GitHub Security Advisory fix into main?▼

Invoke the skill with the full GHSA ID after the reporter confirms the fix on the private fork. It fetches the fork, squash-merges the fix/GHSA branch into local main, resolves conflicts, and produces one polished commit without pushing.

How to resolve CHANGELOG and version conflicts when landing security fixes?▼

The skill keeps both CHANGELOG entries ordered by GHSA ID, trims verbose entries to 2-4 sentences, and for package.json picks the higher version or increments patch so each fix gets a distinct version slot.

Does this skill push the merged fix to origin or publish it?▼

No. The skill never pushes to origin, never publishes to npm, and never edits the advisory on GitHub. Publication is a separate deliberate step the maintainer performs by hand after reviewing the commit.

What happens if local main has diverged from origin during the merge?▼

The skill stops and surfaces the divergence without reconciling it. Local main may be ahead of origin (batched landings), but true divergence requires the user to resolve the upstream state before retrying.

Why does the skill scrub reporter names from commits?▼

Embargoed security fixes must not leak reporter attribution, handles, or disclosure dates into commit messages, comments, or docs. The skill deletes such references during conflict resolution, keeping only the public GHSA identifier.

Related Skills

Explore More Software Engineering Skills→
Arry8Arry8
1

openclaw-ghsa-maintainer

Automate GHSA advisory management for OpenClaw repositories via the GHSA API.

Community
Intermediate
BlockRunAIBlockRunAI
6.6k

release

Executes the full ClawRouter release checklist from version bump through npm publish and GitHub release.

Official
Intermediate
zgsm-aizgsm-ai
4.4k

roo-conflict-resolution

Resolve Git merge conflicts using commit history and code intent.

Official
Advanced
engineers-hub-ltd-in-house-projectengineers-hub-ltd-in-house-project

operational-logging

Implement structured logging patterns for CloudWatch Logs Insights and Datadog Logs.

Official
Intermediate