openclaw-ghsa-maintainer

Automating GHSA advisory workflow management involves applying PATCH API calls to update advisories through a prescribed sequence of inspecting, patching, validating, and publishing security advisories. This skill enforces guardrails to guide maintainers safely end-to-end.

To publish a GHSA advisory safely, you must fetch the advisory state, verify the linked private fork has no open PRs, prepare the advisory Markdown and JSON safely, then apply PATCH calls in the correct sequence for proper state transitions before release.

Private forks must be closed before publishing security advisories to prevent premature exposure of vulnerability details. This skill enforces this guardrail by verifying no open PRs exist on the private fork before allowing the advisory publication state transition.

Yes, you can use this workflow to apply patch updates to existing GHSA advisories. The process relies on prescribed PATCH API calls to update advisory states and content while enforcing sequence operations and respecting repository guardrails.

Managing security advisories requires reading SECURITY.md, obtaining explicit permission, and strictly limiting usage to GHSA workflows. These guardrails ensure safe preparation of advisory Markdown and JSON, preventing unsafe formatting during publication.