skills.rest
vigolium
vigoliumOFFICIAL
Explore all skills by this author →
Website𝕏@VigoliumGitHub

vuln-report

Draft a nine-section GitHub advisory report from one audit finding.

965|142|Updated Mar 8, 2026
Search Tags:#remediation#proof of concept#vulnerability reporting#security advisory#github markdown#source-to-sink
One-click install
npx skills add https://github.com/vigolium/vigolium --skill vuln-report-vigolium
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-report
Source: https://github.com/vigolium/vigolium/tree/main/platform/vigolium-audit/src/content/skills/vuln-report
Command: npx skills add https://github.com/vigolium/vigolium --skill vuln-report-vigolium

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Converts one confirmed security issue into a disclosure-ready, GitHub advisory style vulnerability report that is evidence-driven, consistently structured, and easy to parse.

Core Features & Use Cases

  • Single-bug advisory drafting: Produces exactly one report per confirmed bug with the required nine-section contract for reliable downstream ingestion.
  • Evidence-first formatting: Enforces minimal, decisive facts with embedded fenced code snippets and SHA-pinned GitHub links to source evidence.
  • Source-to-sink clarity: Guides the narrative from attacker-controlled input through validation gaps to the dangerous sink, ending with the root-cause statement inside the flow section.
  • Actionable remediation: Generates concrete fixes that directly close the described source-to-sink gap, optionally including spec/guidance references or fix-commit metadata.

Quick Start

Use the vuln-report skill to draft a single GitHub advisory report by providing one confirmed finding’s evidence (finding title, decisive file paths/lines, proof or reproduction details, and the relevant patch diff or fix hints).

Frequently Asked Questions about vuln-report

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a GitHub advisory vulnerability report from a confirmed finding?▼

A GitHub advisory vulnerability report requires mapping the attacker-controlled input through validation gaps to the dangerous sink, embedding SHA-pinned GitHub markdown references and minimal vulnerable-code snippets as evidence.

What is a source-to-sink flow in security vulnerability reporting?▼

A source-to-sink flow in security vulnerability reporting traces attacker-controlled input from its entry point through validation gaps to the dangerous execution sink, concluding with a root-cause statement inside the report's flow section.

Can I draft multiple vulnerability reports at once for a full security audit?▼

Drafting multiple vulnerability reports simultaneously is not supported; the process strictly outputs one disclosure-ready single-vulnerability GitHub advisory report per confirmed finding to ensure evidence-driven traceability.

What format and evidence do I need to write a proof of concept for coordinated disclosure?▼

Writing a proof of concept for coordinated disclosure requires minimal decisive facts, fenced code snippets, reproduction steps, and SHA-pinned GitHub links to source evidence, formatted within a consistent nine-section advisory structure.

When should I not use an automated vulnerability report format for security advisories?▼

Avoid using this automated vulnerability report format for unconfirmed issues, since the nine-section GitHub advisory structure mandates decisive evidence, minimal vulnerable-code snippets, and concrete remediation tied to a single confirmed bug.

Related Skills

Explore More Legal & Compliance Skills→
n4igmen4igme

sc4-validate

Trace data flows across files to validate vulnerability findings and generate remediation reports.

Community
Advanced
bychrisrbychrisr

deal-with-security-advisory

Manage GitHub Security Advisory response lifecycles with private forks and coordinated disclosure.

Community
Advanced
AgentientAgentient
2

owasp-code-analysis

Detect OWASP Top 10 2021 vulnerabilities in codebases and configurations.

Official
Basic
dapperdiversdapperdivers
1

run-full-scan

Orchestrate reconnaissance, vulnerability scanning, source auditing, and report generation for penetration tests.

Community
Advanced