apache/magpie
60 skills
$npx skills add apache/magpieSkillInstalls
audit-finding-fixFor a batch of findings from a non-security audit tool (`<audit-tool>` — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer / equivalent; full list in the body) against `<upstream>`, ci-runner-auditRead-only audit of GitHub Actions workflow runner compatibility for one repository, an explicit repository set, one Apache project with multiple repositories, or the full Apache GitHub org. Finds obsocommitter-onboardingPost-vote committer and PMC onboarding for Apache projects. Walks the nominator through every step from ICLA check to welcome announcement for both incubating podlings and graduated top-level projectscontributor-activity-sweepRead-only GitHub activity card for a named contributor on <upstream>. Fetches PR authorship, code-review activity, issues, and PR/issue comments over a configurable window. Limited to GitHub-visible acontributor-nominationRead-only nomination brief for a named GitHub contributor on <upstream>. Aggregates GitHub activity across all contribution tracks plus maintainer-supplied off-GitHub signal, and flags vendor-neutralicontributor-sentimentMeasures contributor-sentiment signals on <upstream> over a configurable window: thread tone (first-response classification), time-to-first-reply (median hours), first-PR retention (second-PR rate), acontributor-to-committerRead-only readiness tracker that maps a contributor's GitHub activity against the adopter's PMC-declared committer or PMC thresholds and surfaces a traffic-light brief (Not yet / Approaching / Ready tdependency-auditRead-only dependency vulnerability audit for one repository or a local checkout. Detects the project's dependency manager(s), runs the appropriate audit tool, surfaces patchable findings grouped by sedependency-license-auditRead-only license audit of a project's direct and transitive dependency tree. Detects the dependency manager(s), resolves each dependency's declared license from ecosystem metadata, classifies each agflaky-test-triageRead-only flaky-test detection from GitHub Actions CI run history for one repository. Parses workflow run outcomes over a configurable window, computes per-job failure rates, and distinguishes intermigood-first-issue-authorDraft a single net-new *good first issue* on the configured `<upstream>` repo from one supplied candidate such as a known gap or a small maintainer-named task. The skill first runs a suitability gate good-first-issue-sweepSweep the open `<issue-tracker>` backlog for existing issues that could be labelled as good first issues. Classifies each candidate as READY (propose the GFI label), NEAR-MISS (surface edits to make iissue-backlog-statsRead-only maintainer dashboard for the open general-issue backlog of <issue-tracker>. Surfaces a health rating, prioritised recommendations, age and staleness breakdowns, area pressure ranking, and a issue-deduplicateMerge two open `<issue-tracker>` issues that describe the same root cause, preserving both reporters' context. Proposes a closing comment on the duplicate and a cross-reference comment on the kept ississue-fix-workflowFor a single triaged `<issue-tracker>` issue confirmed as a bug or feature, draft a fix against `<upstream>` on `<default-branch>`. Produces the failing test, the smallest production change, the targeissue-reassessSweep a configured pool of resolved or end-of-life `<issue-tracker>` issues and re-assess each against the current `<default-branch>`. Per-issue: invoke `issue-reproducer` to extract and run the reporissue-reassess-statsRead-only dashboard over a directory of `verdict.json` files produced by `issue-reassess` campaigns. Surfaces a health rating, classification distribution, partial-fix surfaces, oldest-unresolved buckissue-reproducerFor a single `<issue-tracker>` issue identifying a code-level bug, extract the reporter's example code from the issue body, adapt it to run on the current `<default-branch>`, execute via `<runtime>`, issue-stale-sweepSweep open `<issue-tracker>` issues for inactivity past a configurable threshold and propose either a closure (when the issue has been unresponsive long enough to presume abandonment) or an update reqissue-triageFor each open `<issue-tracker>` issue in the configured candidate pool, read the issue body and comments and classify the candidate disposition. On user confirmation, posts a triage-proposal comment tlicense-compliance-auditRead-only license compliance audit for one repository or a local checkout. Checks that a LICENSE file exists, that a NOTICE file is present and complete when required by the declared license, and thatlist-skillsPrint a human-readable index of every skill in this repository, grouped by family prefix (`pr-management`, `security`, `setup`, …) with each skill's name and the first sentence of its `description`. Tmentoring-welcomeDraft a first-contact orientation comment for a first-time contributor on a newly opened issue or PR on the configured `<upstream>` repo. Detects first-time authorship via the GitHub `author_associatinewcomer-issue-explainerGiven an open good-first-issue on the configured `<upstream>` repo, explain it in beginner terms and sketch a concrete approach: which files to read first, what "done" looks like, and where to ask folonboarding-conciergeAnswer a newcomer's "how do I contribute here" question by grounding the response in `CONTRIBUTING.md` and the project's own docs. Classifies the question (setup / workflow / first-issue / out-of-scopoptimize-skillOptimize an existing framework skill (or sweep a set of them) by applying the restructuring patterns proven on the security-skill suite: split an oversized `SKILL.md` into linked sibling docs, lift copairing-multi-agent-reviewFan a local diff through three independent, axis-focused review passes (correctness, security, conventions), then merge the findings into a single structured report. Each pass is isolated so findings pairing-self-reviewRun a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and the upstream default branch), checks correpr-management-code-reviewWalk a maintainer through deep, sequential code review of open pull requests on the configured `<upstream>` repo. Defaults to the **"my reviews"** queue (the union of five maintainer signals — see thepr-management-mentorDraft a teaching-register comment on a single GitHub issue or PR thread on the configured `<upstream>` repo, aimed at a contributor who is missing repo context the maintainer would otherwise have to spr-management-quick-mergeIdentify trivial, low-risk pull requests in the `ready for maintainer review` queue of <upstream> that pass every quality gate and touch only supplementary areas (docs, changelog, translations, tests)pr-management-statsRead-only maintainer dashboard for the open-PR backlog of <upstream>. Surfaces a health rating, prioritised action recommendations, weekly closure velocity trends, area pressure ranking, and a triage-pr-management-triageSweep open pull requests on the configured `<upstream>` repo, classify each one against the project's quality criteria, propose a disposition, and — on the maintainer's confirmation — carry out the acpr-stale-sweepSweep open pull requests on the configured `<upstream>` repo for inactivity past a configurable threshold and propose either a conversion to draft (when the PR is open but has gone quiet) or a closurepre-first-pr-checkRun a newcomer-focused pre-flight checklist on a local branch before opening a pull request. Checks CONTRIBUTING conventions, SPDX headers on new files, commit-message shape (including the Generated-brelease-announce-draftDraft the `[ANNOUNCE]` email body and open (not merge) the site-bump PR for a promoted release of `<upstream>`. Reads release metadata from the planning issue and `<project-config>/release-management-release-archive-sweepScan the release distribution area (`dist/release/<project>/` when `release_dist_backend = svnpubsub`, or the configured distribution location), identify releases past the project's retention rule, anrelease-audit-reportAssemble a per-release audit record from lifecycle artefacts (planning issue, vote thread, artefact list, promote revision, and announcement URL) and propose a PR appending it to the project's audit lrelease-keys-syncDraft the diff that adds the Release Manager's public key to the project's KEYS file (`<keys-file-url>`), emit a paste-ready `svn` (or backend-equivalent) command sequence, remind the RM to upload to release-prepareDraft release preparation artefacts for `<upstream>`: the planning issue, the version-bump and changelog prep PR, or the post-release development-version bump PR. Reads release metadata from `<projectrelease-promoteEmit the backend-shaped promotion command set for a release that has passed its vote. Reads the planning issue (must carry `vote-passed`), constructs the staging → release move for the configured distrelease-rc-cutEmit the paste-ready command sequence to tag an RC, build artefacts, sign each artefact, generate checksums, and stage them to the adopter's distribution backend. Covers Steps 4–5 of the release-managrelease-verify-rcRead-only pre-flight verification of a staged release candidate (RC) for `<upstream>`. Checks artefact integrity (GPG signatures and checksums), Apache RAT licence headers, NOTICE/LICENSE completenessrelease-vote-draftDraft the `[VOTE]` email body and planning-issue comment for an RC of `<upstream>`. Reads RC metadata from the planning issue and `<project-config>/release-management-config.md`; produces a ready-to-crelease-vote-tallyAfter the approval window closes, fetch the approval signal for an RC of `<upstream>`, classify each reply as +1 / 0 / -1 and binding or non-binding against the configured roster, produce the tally sureviewer-routingGiven an open issue or PR, scores the project's configured reviewer roster across three signals — touched-area eligibility, git-history familiarity with the changed paths, and current open-review loadsecurity-cve-allocateWalk a security team member through allocating a CVE for an `<tracker>` tracking issue (governance-gated per `governance.cve_allocation_gate`). Prints the configured `<cve-tool>` allocation URL, waitssecurity-issue-deduplicateMerge two <tracker> tracking issues that describe the same root-cause vulnerability, preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector descrisecurity-issue-fixAttempt to fix a security issue tracked in `<tracker>` by implementing the change in a public `<upstream>` PR. Runs `security-issue-sync` first to reconcile the issue's state, proposes an implementatisecurity-issue-importScan <security-list> for reports that have not yet been copied into <tracker> as tracking issues, present the proposed imports to the user, and — defaulting to *import unless the user rejects upfront*security-issue-import-from-mdOpen one or more `<tracker>` tracking issues from a markdown file containing a batch of security findings. Each finding becomes one tracker landing in the `Needs triage` board column. The file itself security-issue-import-from-prOpen a tracking issue in <tracker> for a security-relevant fix that has already been opened (or merged) as a public PR in <upstream>, in the case where there is no inbound `<security-list>` report. Thsecurity-issue-import-from-scanTriage a security scanner's multi-finding output (read via a pluggable scan-format adapter) and turn findings into security work only after a complete operator-reviewed triage. Reads the scan's findinsecurity-issue-import-via-forwarderOptional sub-skill of `security-issue-import`, `security-issue-invalidate`, and `security-issue-sync` that handles the *relay/forwarder* case: a report that did not arrive directly from the reporter bsecurity-issue-invalidateClose an `<tracker>` tracking issue as invalid: apply the `invalid` label, remove the scope label, post a short closing comment, archive the item from the project board, and — for trackers imported frsecurity-issue-syncSynchronize a security issue in <tracker> with the state of its GitHub discussion, the <security-list> mailing thread, and any <upstream> PRs that fix it. The skill gathers all relevant signals and prsecurity-issue-triageFor each open `<tracker>` issue carrying the `needs triage` label, read body + comments and classify the candidate disposition into one of six classes: VALID / DEFENSE-IN-DEPTH / INFO-ONLY / INVALID /security-tracker-stats-dashboardGenerate a self-contained HTML dashboard of `<tracker>` repository statistics for security-team review.setup-isolated-setup-doctorProbe the secure-agent setup for in-session functional restrictions that block legitimate workflows. Three live probes — SSH agent / Yubikey reachability, localhost port binding, docker / podman runtisetup-isolated-setup-installGuide an adopter through the first-time install of the framework's secure agent setup (bubblewrap + socat + claude-code, sandbox/permissions/clean-env layers). Walks every step interactively; never au