skills.rest
activepieces
activepiecesOFFICIAL
Explore all skills by this author →
WebsiteGitHub

triage-security-advisories

Triage privately-reported GitHub security advisories with scope checks, deep validation, and SLA scoring.

24.2k|4.1k|Updated Dec 3, 2022
Search Tags:#Security#gitHub#sla#advisories#GHSA#vulnerability triage#Code Audit
One-click install
npx skills add https://github.com/activepieces/activepieces --skill triage-security-advisories
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: triage-security-advisories
Source: https://github.com/activepieces/activepieces/tree/main/.agents/skills/triage-security-advisories
Command: npx skills add https://github.com/activepieces/activepieces --skill triage-security-advisories

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Privately-reported vulnerability backlogs in a public GitHub repository are hard to work through: reports cite stale file locations, severities are unverified, SLA deadlines slip unnoticed, and embargoed content must never leak into tracked files. This Skill automates the full triage pipeline for Activepieces repository security advisories.

Core Features & Use Cases

  • Advisory Fetch & Scope-Check: Pulls repository security advisories via the gh API into a gitignored .security-triage/ workspace and filters each against the out-of-scope list in SECURITY.md.
  • Deep Validation: Traces each report from entry point to sink on current main, verifies reachability through auth, tenant-isolation, and input-validation guards, and emits a verdict (CONFIRMED_EXPLOITABLE, THEORETICAL, ALREADY_MITIGATED, FALSE_POSITIVE, OUT_OF_SCOPE) with file:line evidence.
  • SLA Scoring & Reporting: Computes severity-based remediation deadlines (Critical 7d, High 30d, Medium 90d), generates a dashboard and per-advisory review-ready reports, and drafts fix plans on private security/<ghsa-id> branches only after user approval.
  • Use Case: A maintainer asks to triage the reported-vulnerability backlog and receives a consolidated TRIAGE-SUMMARY.md with verdict tallies, duplicates, systemic patterns, and an actionable list sorted by urgency.

Quick Start

Triage the current GitHub security advisory backlog for activepieces and show me which confirmed vulnerabilities are unpatched and breaching SLA.

Frequently Asked Questions about triage-security-advisories

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage GitHub security advisories for a repository?▼

Fetch advisories with `gh api /repos/<owner>/<repo>/security-advisories --paginate`, scope-check each against your SECURITY.md exclusions, then validate reachability from entry point to sink on the current main branch. This Skill automates that pipeline and writes reports to a gitignored .security-triage/ directory.

How to check SLA status on reported vulnerabilities?▼

Run `npm run security:sla -- --source advisory` after fetching advisories. It computes deadlines from the advisory creation date (Critical 7 days, High 30, Medium 90) and writes sla.json plus a dashboard sorted by BREACHED, DUE_SOON, ON_TRACK, and BEST_EFFORT status.

Why does the GitHub advisory API return 403?▼

The gh token lacks security scopes. Run `gh auth refresh -s security_events,repo` to grant the required permissions, then retry the fetch. Without these scopes the security-advisories endpoint always returns 403.

Can I use this for Dependabot dependency alerts?▼

No. Dependabot dependency alerts are handled by the separate triage-dependabot-alerts skill. This Skill covers only privately-reported repository security advisories from the Security tab, though both share the .security-triage/ workspace and SLA script.

How are embargoed vulnerabilities kept out of the public repo?▼

All artifacts (fetched JSON, reports, dashboard) are written to the gitignored .security-triage/ directory, never to tracked files. Fixes are staged on private-fork security/<ghsa-id> branches and no public PR is opened before the embargo lifts.

What verdicts does security advisory validation produce?▼

Each advisory gets one verdict: CONFIRMED_EXPLOITABLE, THEORETICAL, ALREADY_MITIGATED, FALSE_POSITIVE, or OUT_OF_SCOPE, each backed by file:line evidence. Validation re-locates the sink on current main because reported file references and root causes are frequently stale.

Related Skills

Explore More Software Engineering Skills→
SocketDevSocketDev
125

updating-security

Automate Dependabot security alert discovery and remediation on GitHub repositories.

Official
Advanced
openclawopenclaw
388.4k

openclaw-ghsa-maintainer

Inspect, patch, validate, and publish GitHub security advisories for the OpenClaw repository.

Official
Intermediate
gobifrostgobifrost
55

bifrost-secupdate

Automate triage and resolution of GitHub security artifacts for Bifrost.

Official
Advanced
phoenixvcphoenixvc

sync-backlog

Synchronize local backlog items with GitHub or Linear issue trackers.

Official
Advanced