security-cve-allocate

Name: security-cve-allocate
Author: apache

68stars52forks

How to install security-cve-allocate?

apache/magpie/security-cve-allocate

$npx -y skills add apache/magpie --skill security-cve-allocate

Installs into the current project.

Summary

Walk a security team member through allocating a CVE for an <tracker> tracking issue (governance-gated per governance.cve_allocation_gate). Prints the configured <cve-tool> allocation URL, waits for the allocated CVE ID, then updates the tracker in place. Tracker updates: C

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	(example: `<tracker>`)
5	<upstream> → value of `upstream_repo:` in <project-config>/project.md
6	(example: `<upstream>`)
7	<security-list> → value of `mailing_lists.security:` in <project-config>/project.md
8	(example: `<security-list>`)
9	<cve-tool> → the CVE-tool adapter directory selected by
10	`cve_authority.tool:` in <project-config>/project.md
11	(example: `tools/cve-tool-vulnogram/` for the ASF default).
12	Adapter contract: tools/cve-tool/README.md.
13	Before running any bash command below, substitute these with the
14	concrete values from the adopting project's <project-config>/project.md. -->
15
16	# security-cve-allocate
17
18	Walks a security team member through the CVE-allocation step of the
19	[handling process](../../README.md) for a given
20	[`<tracker>`](https://github.com/<tracker>)
21	tracking issue. The work itself — submitting the allocation form on
22	the project's CVE tool, resolved from `cve_authority.allocate_url`
23	in [`<project-config>/project.md`](../../<project-config>/project.md#cve-authority)
24	— is a human step; this skill prepares the clickable link + the
25	exact title to paste into the form, and captures the allocated CVE
26	back into the tracker in one coordinated pass so no step is
27	forgotten.
28
29	Golden rule — propose before applying. Every write to the
30	tracker (label add, body-field update, status-change comment,
31	CVE-JSON regeneration) is a proposal the user must explicitly
32	confirm. The only action the skill performs unilaterally is
33	reading the tracker state and printing the allocation recipe for
34	the user to click through.
35
36	Golden rule — only governance-authorised users can allocate CVEs.
37	The CVE-tool allocation surface is gated by
38	`governance.cve_allocation_gate` in
39	[`<project-config>/project.md`](../../<project-config>/project.md#governance).
40	The full allocation mechanics
41	(form-fill recipe, gating, form fields, fatal mis-allocation,
42	after-allocation wire-back) live in the adapter's docs —
43	[`<cve-tool>/README.md`](../../tools/cve-tool/README.md) names
44	the contract.
45	The per-project URL templates live in
46	[`<project-config>/project.md`](../../<project-config>/project.md#cve-authority).
47	This is not something the skill can work around — a non-authorised
48	user who clicks Allocate sees the button grey out (for the
49	Vulnogram adapter; other adapters surface the same gate as an HTTP
50	403, a "you are not a CNA member" form error, etc.).
51
52	The current governance roster lives at `governance.roster_url`.
53	Authoritative GitHub handles for the subset of authorised
54	members who also sit on the security team are listed in
55	[`<project-config>/release-trains.md`](../../<project-config>/release-trains.md)
56	(release-manager rosters + security-team roster) — use those as the
57	authoritative source when a non-authorised triager needs to ping a
58	governance member to do the actual click-through.
59
60	If the user running this skill is not governance-authorised,
61	Step 3 will produce a clickable URL + a CVE-ready title that the
62	user forwards to a governance member (in the issue comments with
63	an ``@``-mention, on `<security-list>`, or over any other channel
64	the team uses). Once the governance member allocates and reports
65	the allocated `CVE-YYYY-NNNNN` back, the non-authorised user can
66	re-invoke the skill with the CVE ID as an override to resume from
67	Step 4 — so the wiring-back of the allocated ID does not need to
68	be done by the governance member.
69
70	**Golden rule — every `<tracker>` reference is a clickable
71	link**, per Golden rule 2 in

People who liked this also viewed

6 picks

Type

security-cve-allocate

68stars52forks

View on GitHub

How to install security-cve-allocate?

apache/magpie/security-cve-allocate

$npx -y skills add apache/magpie --skill security-cve-allocate

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	(example: `<tracker>`)
5	<upstream> → value of `upstream_repo:` in <project-config>/project.md
6	(example: `<upstream>`)
7	<security-list> → value of `mailing_lists.security:` in <project-config>/project.md
8	(example: `<security-list>`)
9	<cve-tool> → the CVE-tool adapter directory selected by
10	`cve_authority.tool:` in <project-config>/project.md
11	(example: `tools/cve-tool-vulnogram/` for the ASF default).
12	Adapter contract: tools/cve-tool/README.md.
13	Before running any bash command below, substitute these with the
14	concrete values from the adopting project's <project-config>/project.md. -->
15
16	# security-cve-allocate
17
18	Walks a security team member through the CVE-allocation step of the
19	[handling process](../../README.md) for a given
20	[`<tracker>`](https://github.com/<tracker>)
21	tracking issue. The work itself — submitting the allocation form on
22	the project's CVE tool, resolved from `cve_authority.allocate_url`
23	in [`<project-config>/project.md`](../../<project-config>/project.md#cve-authority)
24	— is a human step; this skill prepares the clickable link + the
25	exact title to paste into the form, and captures the allocated CVE
26	back into the tracker in one coordinated pass so no step is
27	forgotten.
28
29	Golden rule — propose before applying. Every write to the
30	tracker (label add, body-field update, status-change comment,
31	CVE-JSON regeneration) is a proposal the user must explicitly
32	confirm. The only action the skill performs unilaterally is
33	reading the tracker state and printing the allocation recipe for
34	the user to click through.
35
36	Golden rule — only governance-authorised users can allocate CVEs.
37	The CVE-tool allocation surface is gated by
38	`governance.cve_allocation_gate` in
39	[`<project-config>/project.md`](../../<project-config>/project.md#governance).
40	The full allocation mechanics
41	(form-fill recipe, gating, form fields, fatal mis-allocation,
42	after-allocation wire-back) live in the adapter's docs —
43	[`<cve-tool>/README.md`](../../tools/cve-tool/README.md) names
44	the contract.
45	The per-project URL templates live in
46	[`<project-config>/project.md`](../../<project-config>/project.md#cve-authority).
47	This is not something the skill can work around — a non-authorised
48	user who clicks Allocate sees the button grey out (for the
49	Vulnogram adapter; other adapters surface the same gate as an HTTP
50	403, a "you are not a CNA member" form error, etc.).
51
52	The current governance roster lives at `governance.roster_url`.
53	Authoritative GitHub handles for the subset of authorised
54	members who also sit on the security team are listed in
55	[`<project-config>/release-trains.md`](../../<project-config>/release-trains.md)
56	(release-manager rosters + security-team roster) — use those as the
57	authoritative source when a non-authorised triager needs to ping a
58	governance member to do the actual click-through.
59
60	If the user running this skill is not governance-authorised,
61	Step 3 will produce a clickable URL + a CVE-ready title that the
62	user forwards to a governance member (in the issue comments with
63	an ``@``-mention, on `<security-list>`, or over any other channel
64	the team uses). Once the governance member allocates and reports
65	the allocated `CVE-YYYY-NNNNN` back, the non-authorised user can
66	re-invoke the skill with the CVE ID as an override to resume from
67	Step 4 — so the wiring-back of the allocated ID does not need to
68	be done by the governance member.
69
70	**Golden rule — every `<tracker>` reference is a clickable
71	link**, per Golden rule 2 in

People who liked this also viewed

6 picks

Type