skills.rest
rsyslog
rsyslogOFFICIAL
Explore all skills by this author →
Website𝕏@rsyslogGitHub

rsyslog-security-pr-review

Reviews rsyslog PR diffs against the project threat model and writes digest-bound security receipts.

2.3k|734|Updated Jun 3, 2013
Search Tags:#diff analysis#security review#threat model#vulnerability triage#Code review#Pull request#rsyslog
One-click install
npx skills add https://github.com/rsyslog/rsyslog --skill rsyslog-security-pr-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rsyslog-security-pr-review
Source: https://github.com/rsyslog/rsyslog/tree/main/.agent/skills/rsyslog-security-pr-review
Command: npx skills add https://github.com/rsyslog/rsyslog --skill rsyslog-security-pr-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reviewing rsyslog pull requests for security regressions is manual and inconsistent; this Skill runs a local, threat-model-aware delta review that classifies findings and produces an auditable receipt before a PR can finish.

Core Features & Use Cases

  • Threat-model-aware delta review: Builds a complete candidate package from the local PR diff via devtools/build-security-review-input.py and routes it through not_applicable, quick, lead_required, or expanded lanes based on component coverage.
  • Candidate validation and triage: Writes candidates.json with introduced-or-worsened status, source/control/sink evidence, and dispositions (confirmed, deferred, hardening, not_actionable), blocking only confirmed PR-introduced Critical/High/Medium findings.
  • Digest-bound receipts and guided resolution: Emits .codex/security-review/receipt.json tied to the input digest, and supports SECURITY RESOLVE <candidate-id> to drive one independently confirmed fix with regression tests and verification.
  • Use Case: Before finishing a code PR in the rsyslog repository, run the review to confirm every expected changed file was covered, no new trust-boundary violations exist, and a current passed receipt is on record.

Quick Start

Ask the assistant to run $rsyslog-security-pr-review to perform the local security delta review for the current rsyslog PR candidate.

Frequently Asked Questions about rsyslog-security-pr-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on an rsyslog pull request?▼

Invoke $rsyslog-security-pr-review or type SECURITY REVIEW on the PR work. The skill builds the candidate package with devtools/build-security-review-input.py, routes the review by coverage, and writes a receipt under .codex/security-review/.

How do I fix a confirmed security finding from the review?▼

Run $rsyslog-security-pr-review resolve <candidate-id> or SECURITY RESOLVE <candidate-id>. This authorizes one fix: a read-only investigation, a minimal repository-native patch with a regression test, independent verification, and a rebuilt receipt after the final digest passes.

When does the security review block a pull request?▼

The review blocks only on confirmed PR-introduced or worsened Critical, High, or Medium findings. Confirmed Low findings warn and normally pass, while discovery-only, hardening, not-actionable, and pre-existing results are reported separately without blocking.

What files does the rsyslog security review require as input?▼

It reads SECURITY.md, doc/ai/security_triage_rubric.md, doc/security/project-threat-model.md, and doc/security/threat-model-components.json, then builds the review input with devtools/build-security-review-input.py rather than a plain git diff.

Why is a security review receipt considered stale?▼

A receipt is stale if a freshly rebuilt input.json has a different diff_digest or model revision, or if reviewed_files contains duplicates or does not exactly equal the rebuilt expected_files set. Stale receipts cannot satisfy FINISH for code PR work.

Can the security review send data to external services?▼

No. The review is strictly local: it never calls external services from repository scripts, never publishes artifacts, and keeps all outputs in the ignored .codex/security-review/ directory. PoCs, credentials, and embargoed facts must never enter tracked files.

Related Skills

Explore More Software Engineering Skills→
eventaservoeventaservo
31

eventaservo-code-review

Compare current changes against the base branch to validate EventaServo Rails patterns.

Official
Advanced
fallow-rsfallow-rs
4.4k

address-pr-comments

Triage GitHub PR review comments and implement the agreed code fixes.

Official
Intermediate
rsyslogrsyslog
2.3k

rsyslog_pr_babysitting

Monitor CI status, review threads, and bot comments on rsyslog pull requests.

Official
Intermediate
phpmacphpmac

vulnerability-checklist

Guide smart contract audits with a structured vulnerability checklist.

Community
Intermediate