skills.rest
JOHNNYWHITEMIKE
JOHNNYWHITEMIKECOMMUNITY
Explore all skills by this author →
GitHub

security-triage

Triage GitHub security advisories by verifying shipped code and trust models.

Updated Apr 8, 2026
Search Tags:#github#triage#security-advisories#ghsa#trust-model#release-validation#maintainer-response
One-click install
npx skills add https://github.com/JOHNNYWHITEMIKE/openclaw --skill security-triage-johnnywhitemike
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-triage
Source: https://github.com/JOHNNYWHITEMIKE/openclaw/tree/main/openclaw/.openclaw/openclaw/.agents/skills/security-triage
Command: npx skills add https://github.com/JOHNNYWHITEMIKE/openclaw --skill security-triage-johnnywhitemike

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps maintainers quickly and accurately decide whether a GitHub security advisory should be closed or kept open, reducing both false closes and unnecessary regressions by verifying the exact shipped state and implicated code paths.

Core Features & Use Cases

  • Evidence-driven close/keep decisions: Uses explicit criteria to close only when a duplicate, out-of-scope, already fixed before affected releases/tags, or invalid against shipped behavior is proven.
  • Release/tag and commit verification: Guides verification of implicated fixes across git tags, tag containment, and npm published versions (including exact fix commit checks and optional file inspection).
  • Trust-model and boundary checks: Prioritizes SECURITY.md’s stated trust classes and prevents over-interpreting local/control-only issues as security boundary bypasses.
  • Maintainer-ready response drafting: Produces a detailed reply template that includes the GHSA link, exact reasons, code references, shipped facts, and the final “copy to clipboard” step.

Quick Start

Use this skill to triage a GHSA by reading SECURITY.md, fetching the GHSA via the GitHub API, verifying the affected code paths and shipped tag/npm state, then drafting a maintainer-ready close reply in one copyable block.

Frequently Asked Questions about security-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage GitHub security advisories to decide whether to close or keep them open?▼

GitHub security advisory triage involves reading SECURITY.md, fetching GHSA details via the GitHub API, verifying implicated code paths, and validating affected versus fixed timing across git tags and npm releases to determine whether to close, keep open, or narrow the advisory's impact.

What criteria justify closing a GHSA security advisory without causing regressions?▼

Closing a GHSA is justified only when evidence proves it is a duplicate, out-of-scope, already fixed before affected releases or tags, or invalid against shipped behavior. Verifying exact fix commits and npm published versions prevents false closes and unnecessary regressions.

How do I validate if a GitHub security advisory actually affects my npm package release?▼

Validating a GitHub security advisory against an npm release requires checking tag containment, verifying the exact fix commit across git tags, and inspecting published npm versions to confirm whether affected code paths exist in the shipped release or were already fixed.

How does SECURITY.md trust model validation work for GitHub security advisories?▼

SECURITY.md trust model validation prioritizes stated trust classes to prevent over-interpreting local or control-only issues as security boundary bypasses. It ensures advisory triage respects the project's defined trust boundaries before drafting a maintainer-ready response.

Can I generate a maintainer-ready reply for a GHSA triage decision that includes code references?▼

Yes, GHSA triage can produce a maintainer-ready reply template containing the GHSA link, exact reasons, code references, and shipped facts in a single copyable block. This output satisfies the need for clear communication of close or keep decisions to project maintainers.

Related Skills

Explore More Legal & Compliance Skills→
costiashcostiash
4

council-advice

Synthesize multi-model advisories into structured architectural guidance and implementation plans.

Community
Advanced
enclawedenclawed
2

security-triage

Triage GitHub security advisories for Enclawed with closure decisions and maintainer-ready responses.

Community
Advanced
zyj18860969891-bytezyj18860969891-byte

security-triage

Triages GitHub security advisories for OpenClaw with git tag and npm state verification.

Community
Advanced
Arry8Arry8
1

security-triage

Triage GitHub security advisories with close/keep decisions and tag verification.

Community
Advanced