security-issue-deduplicate

Name: security-issue-deduplicate
Author: apache

68stars52forks

How to install security-issue-deduplicate?

apache/magpie/security-issue-deduplicate

$npx -y skills add apache/magpie --skill security-issue-deduplicate

Installs into the current project.

Summary

Merge two <tracker> tracking issues that describe the same root-cause vulnerability, preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector description. Updates the kept issue's body in place, closes the duplicate with the `du

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	(example: <tracker>)
5	<upstream> → value of `upstream_repo:` in <project-config>/project.md
6	(example: <upstream>)
7	<cve-tool> → CVE-tool adapter directory under `tools/` named by
8	`cve_authority.tool` in <project-config>/project.md
9	(example: cve-tool-vulnogram for the ASF default).
10	Before running any bash command below, substitute these with the
11	concrete values from the adopting project's <project-config>/project.md. -->
12
13	# security-issue-deduplicate
14
15	Merges two `<tracker>` tracking issues that describe the
16	same underlying vulnerability. The output is a single tracker
17	("the kept issue") that carries every reporter's credit, every
18	mailing-list thread, and every independent report's body, with the
19	other tracker ("the dropped issue") closed and labelled
20	`duplicate`.
21
22	This is one of the few places in the security workflow where a
23	piece of reporter-supplied content (the dropped issue's body) moves
24	from one tracker to another. Since the target tracker is private to
25	`<tracker>`, no confidentiality boundary is crossed, but
26	the skill must still preserve every reporter's credit verbatim and
27	surface the merge in a status comment on both trackers so the audit
28	trail stays complete.
29
30	Golden rule — propose before applying. Every merge is a
31	proposal: the skill computes the merged body, the two status
32	comments, the label/close-issue actions, and the CVE-JSON regen
33	command, and shows all of them to the user. Nothing is applied
34	until the user confirms. There is no fast-path.
35
36	Golden rule — never merge across scopes. Two trackers with
37	different scope labels must not be merged. The set of scope
38	labels the project recognises comes from `scope_detection.labels`
39	in [`<project-config>/project.md`](../../<project-config>/project.md#scope-detection)
40	(cross-referenced from [`<project-config>/scope-labels.md`](../../<project-config>/scope-labels.md)).
41	For example, with scope labels `<scope-a>`, `<scope-b>`, and
42	`<scope-c>`, `<scope-a>` vs. `<scope-b>` or `<scope-a>` vs.
43	`<scope-c>` are the typical mismatches; other adopters declare
44	their own. If an external reporter rediscovers the same
45	bug in two different products' surfaces, that is a multi-scope
46	report and the resolution is a scope split handled by the
47	`security-issue-sync` skill, not a dedupe. This skill refuses to
48	operate when the two candidate trackers have different scope
49	labels, and the proposal says so explicitly.
50
51	**Golden rule — every `<tracker>` / `<upstream>` reference is
52	clickable in the surface it lands on.** Whenever this skill emits
53	a reference to either candidate tracker, a sibling tracker, or
54	any cited PR — the proposal shown before merge, the updated kept
55	issue body (which carries the duplicate's reporter-credit and
56	mailing-list-thread back-references), the closing comment on the
57	duplicate, the recap output — the reference must be one click
58	away in whatever surface it lands on:
59
60	- On markdown surfaces (the updated kept issue body, the
61	closing comment on the duplicate, the regenerated CVE JSON
62	attachment's reference URLs): use the markdown link form per
63	[`AGENTS.md` § Linking tracker issues and PRs](../../AGENTS.md#linking-tracker-issues-and-prs):
64	- Kept / duplicate `<tracker>` issues: `[<tracker>#NNN](https://github.com/<tracker>/issues/NNN)`
65	- `<upstream>` PR (e.g. cited fix): `[<upstream>#NNN](https://github.com/<upstream>/pull/NNN)`
66	- Comment: link to the `#issuecomment-<C>` anchor.
67
68	- On terminal surfaces (the pre-merge proposal, the recap):
69	wrap the visible short form in **OSC 8 hyperlink escape

People who liked this also viewed

6 picks

Type

security-issue-deduplicate

68stars52forks

View on GitHub

How to install security-issue-deduplicate?

apache/magpie/security-issue-deduplicate

$npx -y skills add apache/magpie --skill security-issue-deduplicate

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	(example: <tracker>)
5	<upstream> → value of `upstream_repo:` in <project-config>/project.md
6	(example: <upstream>)
7	<cve-tool> → CVE-tool adapter directory under `tools/` named by
8	`cve_authority.tool` in <project-config>/project.md
9	(example: cve-tool-vulnogram for the ASF default).
10	Before running any bash command below, substitute these with the
11	concrete values from the adopting project's <project-config>/project.md. -->
12
13	# security-issue-deduplicate
14
15	Merges two `<tracker>` tracking issues that describe the
16	same underlying vulnerability. The output is a single tracker
17	("the kept issue") that carries every reporter's credit, every
18	mailing-list thread, and every independent report's body, with the
19	other tracker ("the dropped issue") closed and labelled
20	`duplicate`.
21
22	This is one of the few places in the security workflow where a
23	piece of reporter-supplied content (the dropped issue's body) moves
24	from one tracker to another. Since the target tracker is private to
25	`<tracker>`, no confidentiality boundary is crossed, but
26	the skill must still preserve every reporter's credit verbatim and
27	surface the merge in a status comment on both trackers so the audit
28	trail stays complete.
29
30	Golden rule — propose before applying. Every merge is a
31	proposal: the skill computes the merged body, the two status
32	comments, the label/close-issue actions, and the CVE-JSON regen
33	command, and shows all of them to the user. Nothing is applied
34	until the user confirms. There is no fast-path.
35
36	Golden rule — never merge across scopes. Two trackers with
37	different scope labels must not be merged. The set of scope
38	labels the project recognises comes from `scope_detection.labels`
39	in [`<project-config>/project.md`](../../<project-config>/project.md#scope-detection)
40	(cross-referenced from [`<project-config>/scope-labels.md`](../../<project-config>/scope-labels.md)).
41	For example, with scope labels `<scope-a>`, `<scope-b>`, and
42	`<scope-c>`, `<scope-a>` vs. `<scope-b>` or `<scope-a>` vs.
43	`<scope-c>` are the typical mismatches; other adopters declare
44	their own. If an external reporter rediscovers the same
45	bug in two different products' surfaces, that is a multi-scope
46	report and the resolution is a scope split handled by the
47	`security-issue-sync` skill, not a dedupe. This skill refuses to
48	operate when the two candidate trackers have different scope
49	labels, and the proposal says so explicitly.
50
51	**Golden rule — every `<tracker>` / `<upstream>` reference is
52	clickable in the surface it lands on.** Whenever this skill emits
53	a reference to either candidate tracker, a sibling tracker, or
54	any cited PR — the proposal shown before merge, the updated kept
55	issue body (which carries the duplicate's reporter-credit and
56	mailing-list-thread back-references), the closing comment on the
57	duplicate, the recap output — the reference must be one click
58	away in whatever surface it lands on:
59
60	- On markdown surfaces (the updated kept issue body, the
61	closing comment on the duplicate, the regenerated CVE JSON
62	attachment's reference URLs): use the markdown link form per
63	[`AGENTS.md` § Linking tracker issues and PRs](../../AGENTS.md#linking-tracker-issues-and-prs):
64	- Kept / duplicate `<tracker>` issues: `[<tracker>#NNN](https://github.com/<tracker>/issues/NNN)`
65	- `<upstream>` PR (e.g. cited fix): `[<upstream>#NNN](https://github.com/<upstream>/pull/NNN)`
66	- Comment: link to the `#issuecomment-<C>` anchor.
67
68	- On terminal surfaces (the pre-merge proposal, the recap):
69	wrap the visible short form in **OSC 8 hyperlink escape

People who liked this also viewed

6 picks

Type