skills.rest
brikkoAI
brikkoAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-triage

Triage Brikko Studio security advisories against the documented trust model and shipped release state.

1|Updated May 3, 2026
Search Tags:#vulnerability-assessment#ghsa#trust-model#maintainer-workflow#security-triage#brikko-studio#advisory-review
One-click install
npx skills add https://github.com/brikkoAI/brikko-studio --skill security-triage-brikkoai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-triage
Source: https://github.com/brikkoAI/brikko-studio/tree/main/packages/core/.agents/skills/security-triage
Command: npx skills add https://github.com/brikkoAI/brikko-studio --skill security-triage-brikkoai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill eliminates inconsistent and high-risk manual review of Brikko Studio security advisories, GHSA reports, and draft security issues, ensuring all triage decisions align with the project's documented trust model, shipped release state, and security scope to avoid over-closing valid vulnerabilities or shipping unnecessary regressions.

Core Features & Use Cases

  • Structured Decision Workflow: Follows a strict close bar and review method to evaluate advisories against scope, shipped behavior, and exploit path validity.
  • Evidence-Backed Output: Generates maintainer-ready, precise comments for GitHub Security Advisories with exact code references, shipped tag facts, and optional hardening notes.
  • Use Case: A Brikko maintainer reviewing a new GHSA for a potential local state access issue can use this skill to confirm the issue is out of scope per SECURITY.md, verify it does not affect the latest shipped release, and draft a compliant comment for the advisory thread.

Quick Start

Use the security-triage skill to review the open Brikko Studio GHSA and draft a maintainer-ready triage comment with supporting evidence.

Frequently Asked Questions about security-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage GitHub Security Advisories for a project?▼

Triage GitHub Security Advisories by evaluating reports against the project's documented trust model, verifying shipped release tags, validating exploit paths, and drafting evidence-backed closure comments.

What is a security trust model and how does it affect vulnerability assessment?▼

A security trust model defines valid attack surfaces and scope boundaries for vulnerability assessment. Checking advisory reports against the project's SECURITY.md scope prevents incorrectly closing valid vulnerabilities or shipping regressions.

How do I draft maintainer-ready comments for GHSA reports?▼

Draft maintainer-ready comments for GHSA reports by citing exact code references, confirming shipped tag status, validating the exploit path, and providing optional hardening notes aligned with the security triage workflow.

Can I use this advisory review process for draft security issues not yet published?▼

Yes, the advisory review process applies to draft security issues. It evaluates the draft against the shipped release state and canonical duplicate checks before deciding on closure or requesting changes.

What are the limitations of manual security triage for open source advisories?▼

Manual security triage risks inconsistent decisions and over-closing valid vulnerabilities. Without enforcing strict close bars and evidence-based verification, maintainers may ship unnecessary regressions or miss scope misalignment.

Related Skills

Explore More Software Engineering Skills→
frankhli843frankhli843

security-triage

Triage GitHub security advisories and verify tags, commits, and trust models.

Community
Advanced
wangqianCAIwangqianCAI

security-triage

Triage OpenClaw security advisories and GHSA reports by verifying shipped code paths.

Community
Advanced
philo-grovesphilo-groves
12

maxtac-supply-chain-triage

Automate initial triage of supply-chain vulnerabilities from source code to shipped artifacts.

Community
Advanced
pellepimpellepim

node-security

Automate security review and OWASP Top 10 vulnerability assessment for Node.js applications.

Community
Advanced