skills.rest
github
githubOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-advisory-compat-enforcer

Updates compat.json version enforcement policies based on verified GitHub security advisories.

5.1k|530|Updated Aug 12, 2025
Search Tags:#schema validation#gitHub#vulnerability remediation#GHSA#security advisory#version enforcement#compat.json
One-click install
npx skills add https://github.com/github/gh-aw --skill security-advisory-compat-enforcer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-advisory-compat-enforcer
Source: https://github.com/github/gh-aw/tree/main/.github/skills/security-advisory-compat-enforcer
Command: npx skills add https://github.com/github/gh-aw --skill security-advisory-compat-enforcer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Translating a GitHub security advisory into a correct, minimal version-enforcement change in .github/aw/compat.json is error-prone: it requires verifying advisory evidence, choosing the right policy field, preserving unrelated settings, and validating the result. This Skill enforces that disciplined process end to end.

Core Features & Use Cases

  • Evidence-backed advisory retrieval: Fetches advisory details via authenticated or public GitHub API endpoints and independently verifies patched versions against releases or registries, never inventing CVEs, ranges, or severities.
  • Correct policy field selection: Distinguishes between minimumVersion hard floors, blockedVersions exact denials, minRecommendedVersion warnings, and agent compatibility rows, applying only the narrowest justified edit.
  • Remediation documentation and validation: Updates .github/aw/compat.md with remediation and verification steps, then validates against the JSON schema, the repository's compat validation task, and runtime boundary behavior.
  • Use Case: A GHSA is published against the gh-aw compiler. Use this Skill to verify the advisory and patched release, block the vulnerable versions in compat.json, document the remediation, and confirm schema and runtime validation pass.

Quick Start

Review GHSA-8h78-hpm7-29gg and update .github/aw/compat.json to block the affected versions with verified evidence.

Frequently Asked Questions about security-advisory-compat-enforcer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I update compat.json based on a GitHub security advisory?▼

Retrieve the advisory via `gh api repos/OWNER/REPO/security-advisories/GHSA-ID` or the public advisories endpoint, verify the patched version against a published release, then make the narrowest edit to the correct policy field and validate against the JSON schema.

What is the difference between minimumVersion and blockedVersions in compat.json?▼

minimumVersion is a hard floor that fails activation for every compiler version below it, while blockedVersions rejects only the exact listed versions. Use blockedVersions when a continuous minimum floor would be inaccurate for the affected range.

Can I update compat.json if the security advisory is not accessible?▼

Only if the user explicitly directs use of a supplied target version despite inaccessible advisory metadata, and that limitation must be documented. Never fabricate advisory details such as affected ranges, CVEs, or severity.

Does blocking a vulnerable compiler version fix already generated workflows?▼

No. Blocking a vulnerable version prevents its execution but does not repair previously generated workflow artifacts. Existing generated workflows must be recompiled and redeployed with a patched compiler version.

How is a compat.json change validated before completion?▼

Run the repository's compat validation task, validate the file against compat.schema.json with a JSON Schema Draft 7 validator, confirm compat.md documents every blocked version, and test runtime behavior at versions below, at, and above the changed boundary.

Related Skills

Explore More Software Engineering Skills→
sc30gswsc30gsw
11

dependabot-check

Analyze Dependabot security advisories and propose remediation strategies.

Community
Intermediate
nexu-ionexu-io
3.2k

static-deploy

Deploy static pages to Nexu-hosted domains with Wrangler and Cloudflare Pages.

Official
Advanced
getsentrygetsentry
8.7k

fix-security-vulnerability

Analyze Dependabot security alerts and propose fixes in GitHub repositories.

Official
Advanced
AoManohAoManoh

auggie-mcp

Retrieve semantic codebase leads and recover external task indexes via Auggie MCP.

Community
Intermediate