skills.rest
srgaba
srgabaCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-triage

Triages GitHub security advisories for OpenClaw with verified close or keep decisions.

Updated Mar 30, 2026
Search Tags:#code review#vulnerability#github#advisory#maintainer#ghsa#security triage
One-click install
npx skills add https://github.com/srgaba/open-claw --skill security-triage-srgaba
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-triage
Source: https://github.com/srgaba/open-claw/tree/main/project/.agents/skills/security-triage
Command: npx skills add https://github.com/srgaba/open-claw --skill security-triage-srgaba

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Maintainers reviewing GitHub Security Advisories (GHSA) often struggle to decide confidently whether to close or keep a report, risking either closing real vulnerabilities or shipping unnecessary regressions. This Skill provides a disciplined triage workflow that grounds every decision in shipped tags, exact commits, and the project's trust model. ## Core Features & Use Cases - High-Confidence Close/Keep Decisions: Applies a strict close bar (duplicate, invalid, out of scope, or fixed before release) so advisories are never closed just because main is fixed. - Shipped-State Verification: Verifies the exact affected state using git tags, npm release versions, and fix-commit containment checks before drafting any response. - Maintainer-Ready Replies: Produces a firm, specific close response with exact code refs, tag facts, and fix commits, then copies it to the clipboard via pbcopy. - Use Case: A maintainer receives a new GHSA claiming a boundary bypass. The Skill reads SECURITY.md, fetches the advisory via the GitHub API, checks whether the latest shipped tag is affected, and drafts a close reply citing the exact trust-model clause and release facts. ## Quick Start Triage GHSA report <GHSA-ID> for the OpenClaw repository and draft a maintainer-ready close or keep-open response.

Frequently Asked Questions about security-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a GitHub Security Advisory (GHSA) as a maintainer?▼

Read SECURITY.md, fetch the advisory with gh api, inspect the implicated code paths, and verify shipped state with git tags and npm versions. Then decide close, keep open, or keep open but narrow based on the trust model and exploit path.

When should a security advisory be closed versus kept open?▼

Close only if it is a duplicate, invalid against shipped behavior, out of scope under SECURITY.md, or fixed before any affected release. Do not close just because main is fixed if the latest shipped tag or npm release is still affected.

How do I verify whether a fix commit is included in a released version?▼

Use git tag --contains <commit> to see which tags include the fix, list recent tags with git tag --sort=-creatordate, and check the published npm version with npm view. You can also inspect a file at a tag with git show <tag>:<path>.

What kinds of security reports are usually out of scope?▼

Reports requiring attacker-controlled trusted local state, same-host same-user process access to local state, or helper behavior differing from documented config semantics are usually out of scope. Prompt injection alone without a real boundary bypass is also typically not a valid boundary violation.

What tools are required to run this security triage workflow?▼

The workflow requires the GitHub CLI (gh) for advisory API access and issue/PR search, git for tag and commit verification, npm for release version checks, and pbcopy on macOS to copy the final response to the clipboard.

Related Skills

Explore More Software Engineering Skills→
superagent-aisuperagent-ai
76

security-disclosure-triage

Evaluate security advisories against repository checkouts and assign severity.

Official
Advanced
zebbernzebbern
5

cve-advisory

Generate CVE-format security advisories compliant with CNA rules.

Community
Advanced
Cogni-AI-OUCogni-AI-OU
3

security-audit

Audit codebases for vulnerabilities, dependencies, secrets, and patch proposals.

Official
Advanced
wuv-dreamguidewuv-dreamguide

security-triage

Triage GitHub security advisories and GHSA reports into close, keep, or narrow decisions.

Official
Advanced