skills.rest
nexus-substrate
nexus-substrateOFFICIAL
Explore all skills by this author →
GitHub

security-advisory-response

Coordinate GitHub Security Advisory response workflows with private-fork patching and zero-disclosure publication.

18|1|Updated Jan 3, 2026
Search Tags:#release sequencing#security advisory#coordinated disclosure#private fork patching#CVE response#GitHub GHSA
One-click install
npx skills add https://github.com/nexus-substrate/nexus-agents --skill security-advisory-response-nexus-substrate
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-advisory-response
Source: https://github.com/nexus-substrate/nexus-agents/tree/main/skills/security-advisory-response
Command: npx skills add https://github.com/nexus-substrate/nexus-agents --skill security-advisory-response-nexus-substrate

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps teams respond to GitHub Security Advisories with a disciplined coordinated-disclosure process that protects confidentiality until the fix is ready.

Core Features & Use Cases

  • Confidential triage and severity assessment: Quickly evaluates severity, affected versions, and exploitability to decide whether to fast-track remediation.
  • Operator-ready acknowledgment drafting: Prepares private-thread messaging for a human operator to post within required timelines.
  • Private-fork patching and zero-disclosure release: Ensures fixes happen on a temporary private fork, validated locally before publication, and then published in a tightly controlled window with the release.
  • Use Case: A reporter files a GHSA for a potential authentication bypass; the Skill guides coordinated triage, drafting acknowledgment text, patching on a private fork with regression tests, and publishing alongside the patched release.

Quick Start

Use this skill when you need to coordinate a secure, confidential GitHub Security Advisory response for the repository and ensure the advisory and release are published in the same disclosure window.

Frequently Asked Questions about security-advisory-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I coordinate a GitHub Security Advisory response without accidentally leaking the vulnerability?▼

Coordinated disclosure for a GitHub Security Advisory requires triage severity gating, private-fork patching, and strict zero-disclosure-window sequencing to publish the advisory and release simultaneously. This ensures confidentiality until a validated fix is published.

What is the process for patching a CVE on a private fork before publishing a release?▼

Patching a CVE on a private fork involves creating a temporary private fork, applying fixes with disciplined branch and commit naming, validating locally with regression tests, and then cutting the release in a tightly controlled disclosure window.

How do I draft an acknowledgment message for a reporter who filed a GHSA?▼

Drafting an acknowledgment for a GHSA involves preparing private-thread messaging for a human operator to post within required timelines, ensuring reporter-facing coordinated-disclosure scenarios are handled with operator-ready text.

How should I sequence release publication and advisory publication for coordinated CVE disclosure?▼

Sequencing release and advisory publication requires a strict zero-disclosure window. You validate the fix locally on a private fork, then publish the advisory and cut the patched release simultaneously to prevent premature exposure.

Can I use this coordinated disclosure workflow for escalated reporter-facing security scenarios?▼

Yes, this workflow applies to both reporter-filed security advisories and escalated reporter-facing coordinated-disclosure scenarios, guiding triage, acknowledgment drafting, and private-fork patching for any GitHub GHSA.

Related Skills

Explore More Legal & Compliance Skills→
LuisSambranoLuisSambrano
7

repo-showcase

Synchronize architecture documentation from private repositories to public showcases via GitHub Actions.

Community
Advanced
bychrisrbychrisr

deal-with-security-advisory

Manage GitHub Security Advisory response lifecycles with private forks and coordinated disclosure.

Community
Advanced
githubgithub
4.9k

github-issue-query

Query GitHub issues with jq filters via the gh CLI.

Official
Intermediate
travelinman1013travelinman1013

deal-with-security-advisory

Coordinate GitHub Security Advisory responses from detection through synchronized public release.

Community
Intermediate