security-triage

Name: security-triage
Availability: InStock
Author: Arry8

Triage GitHub security advisories with close/keep decisions and tag verification.

1|Updated Mar 30, 2026

Search Tags:#security #risk-assessment #triage #code-review #openclaw #advisories #ghsa

Ready to run

npx skills add https://github.com/Arry8/openclaw-edge --skill security-triage

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-triage
Source: https://github.com/Arry8/openclaw-edge/tree/main/.agents/skills/security-triage
Command: npx skills add https://github.com/Arry8/openclaw-edge --skill security-triage

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, and a trust-model workflow to streamline vulnerability handling.

Core Features & Use Cases

Structured review workflow for security advisories, GHSA reports, and drafts with a defined close/keep decision process.
Verification steps including checking shipped state, tags, and implicated code paths to avoid regressions.
Optional hardening notes and a publish-ready response for maintainers.

Quick Start

Load the SECURITY.md and the target GHSA, read the advisories and implicated code paths, and apply the triage criteria to draft a response.

Frequently Asked Questions about security-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I triage GitHub security advisories to decide whether to close or keep an issue?▼

Triage GitHub security advisories by verifying implicated code paths, shipped states, git tags, and commits to make high-confidence close or keep decisions. A structured checklist confirms whether the vulnerability actually affects your codebase.

How does verifying git tags and shipped states prevent regressions during security advisory triage?▼

Verifying git tags and shipped states prevents regressions by confirming whether the implicated code is actually released. Checking the advisory against the current codebase ensures you only keep or close issues based on deployed, vulnerable versions.

What is the process for reviewing GHSA reports against the OpenClaw codebase?▼

Reviewing GHSA reports involves reading SECURITY.md, inspecting the advisory, and verifying the shipped state using commands like git tag and npm view. This structured workflow confirms implicated code paths before drafting a maintainer-ready response.

How do I draft a maintainer-ready response for a security advisory draft?▼

Draft a maintainer-ready response by applying triage criteria after verifying tags, commits, and implicated code paths. The process includes optional hardening notes to address vulnerabilities and streamline communication for repository maintainers.

Can I triage security advisories without reading the SECURITY.md file?▼

Security advisory triage requires reading SECURITY.md as the initial step to understand the project's security policies and reporting structure. Skipping this file bypasses the trust-model workflow needed for accurate vulnerability handling decisions.

When should I include hardening notes in a security advisory triage response?▼

Include hardening notes when the triage process confirms an active vulnerability requiring additional protective measures. These optional notes accompany the close or keep decision to help maintainers implement supplementary security safeguards.