skills.rest
wangqianCAI
wangqianCAICOMMUNITY
Explore all skills by this author →
GitHub

security-triage

Triage OpenClaw security advisories and GHSA reports by verifying shipped code paths.

Updated Jun 18, 2026
Search Tags:#security#vulnerability#maintenance#triage#openclaw#ghsa
One-click install
npx skills add https://github.com/wangqianCAI/OBI --skill security-triage-wangqiancai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-triage
Source: https://github.com/wangqianCAI/OBI/tree/main/.agents/skills/security-triage
Command: npx skills add https://github.com/wangqianCAI/OBI --skill security-triage-wangqiancai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the bottleneck in maintaining high-quality security standards by providing a structured, evidence-based workflow for triaging OpenClaw security advisories and GHSA reports.

Core Features & Use Cases

  • Evidence-Based Triage: Automates the verification of shipped code paths, tags, and release versions to determine if an issue is valid or a duplicate.
  • Standardized Response: Generates professional, maintainer-ready comments that balance security hardening with functional stability.
  • Use Case: When a new GHSA report arrives, use this skill to quickly verify if the vulnerability exists in the latest shipped tag, check for existing fixes, and draft a response that avoids unnecessary regressions.

Quick Start

Use the security-triage skill to analyze the provided GHSA report and draft a maintainer response based on the current shipped state.

Frequently Asked Questions about security-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage GHSA reports against shipped code paths?▼

Triage GHSA reports by verifying shipped code paths and trust-model boundaries against fix commits and release tags. This process validates if the vulnerability exists in the latest shipped tag or is a duplicate.

What is the best way to verify if a GitHub security advisory affects my release tags?▼

Verifying GitHub security advisories involves checking fix commits against local git repository release tags. This evidence-based triage determines if the issue is valid in the current shipped state before drafting a response.

Do I need GitHub CLI integration to assess OpenClaw security vulnerabilities?▼

Yes, GitHub CLI integration and local git repository access are required to assess OpenClaw security vulnerabilities. These dependencies allow you to validate fix commits and verify trust-model boundaries during vulnerability assessment.

How do I draft a maintainer response for a security advisory without causing regressions?▼

Draft a maintainer response for a security advisory by balancing security hardening with functional stability. This standardized approach generates professional comments based on the verified shipped state of the code.

Can I automate vulnerability assessment for duplicate GHSA reports?▼

Automate vulnerability assessment for duplicate GHSA reports by verifying existing fixes and shipped code paths. This evidence-based workflow checks the latest tags to determine validity and streamline issue closure.

When should I not use automated triage for security advisories?▼

Automated triage for security advisories is not suitable when you lack local git repository access or GitHub CLI integration. It is designed specifically for maintainer workflows involving vulnerability assessment and security hardening.

Related Skills

Explore More Software Engineering Skills→
spartDevspartDev
6

Release Automation

Automate SEMVER version bumps, changelog generation, and release pull requests.

Community
Advanced
brainbrewlabsbrainbrewlabs
7

code-fixing

Fix code scanner, security auditor, and linter issues with verified edits and reports.

Official
Intermediate
uphiagouphiago
1.1k

hunt-llm-ai

Identify exploitable LLM/AI vulnerabilities crossing trust boundaries with validation gates.

Community
Advanced
Arry8Arry8
1

security-triage

Triage GitHub security advisories with close/keep decisions and tag verification.

Community
Advanced