skills.rest
191854169
191854169COMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-triage

Triage GitHub security advisories with trust-model checks and exact commit verification.

Updated Apr 9, 2026
Search Tags:#triage#security-advisories#ghsa#verifications#trust-model#maintainer-response
One-click install
npx skills add https://github.com/191854169/openclawFork --skill security-triage-191854169
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-triage
Source: https://github.com/191854169/openclawFork/tree/main/.agents/skills/security-triage
Command: npx skills add https://github.com/191854169/openclawFork --skill security-triage-191854169

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to post and copy to clipboard.

Core Features & Use Cases

  • Automated triage workflow: Guiding maintainers to classify advisories as close/open/keep-open based on trust-models and shipped state, with precise checks against tags, releases, and commits.
  • Verification & reproducibility: Enforces exact commands to verify affected code paths and shipped state, and generates a ready-to-share maintainer response.
  • Use Case: When a new GHSA report arrives, run this skill to decide whether to close, keep open, or narrow the issue with exact references and a copy-ready reply.

Quick Start

Run the triage workflow against the latest GHSA report to generate a ready-to-post maintainer reply.

Frequently Asked Questions about security-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage GitHub security advisories to decide whether to close or keep them open?▼

Triage GitHub security advisories by validating trust-models and verifying shipped state against exact tags and commits. This process generates high-confidence close or keep-open decisions, ensuring your final classification aligns with verifiable code references and shipped releases.

What is the best way to verify affected code paths when responding to a GHSA report?▼

Verifying affected code paths for a GHSA report requires running exact commands to check tags, releases, and commits against the shipped state. This validation confirms whether the reported vulnerability actually impacts your distributed software before you generate a maintainer response.

Can I automatically generate a maintainer response for security advisories?▼

You can automatically generate a ready-to-post maintainer response for security advisories after completing trust-model checks and shipped-state verification. The output includes copy-to-clipboard text with optional hardening notes and exact references for immediate posting.

Does GitHub security advisory triage support reproducible workflows with exact code references?▼

GitHub security advisory triage supports reproducible workflows by enforcing exact code references, trust-model validation, and shipped-state checks. This ensures every close, open, or keep-open decision can be independently verified using the exact commands and commit references generated.

When should I narrow a GitHub security advisory instead of closing it completely?▼

Narrow a GitHub security advisory instead of closing it when shipped-state verification confirms the vulnerability exists but only impacts specific tags or commits. This allows you to keep the advisory open with exact code references while narrowing the affected scope.

Related Skills

Explore More Software Engineering Skills→
wangqianCAIwangqianCAI

security-triage

Triage OpenClaw security advisories and GHSA reports by verifying shipped code paths.

Community
Advanced
aaronjmarsaaronjmars
626

Vuln Tracker

Audits vuln-scanner security PR and disclosure lifecycle status against live GitHub data.

Community
Advanced
AribSudiaAribSudia
2

arib-check-security

Audit code for OWASP Top 10 vulnerabilities and supply-chain dependency risks.

Community
Advanced
AG064AG064
2

security-triage

Triage GitHub security advisories with tag and commit verification.

Community
Advanced