security-issue-fix

Name: security-issue-fix
Author: apache

68stars52forks

How to install security-issue-fix?

apache/magpie/security-issue-fix

$npx -y skills add apache/magpie --skill security-issue-fix

Installs into the current project.

Summary

Attempt to fix a security issue tracked in <tracker> by implementing the change in a public <upstream> PR. Runs security-issue-sync first to reconcile the issue's state, proposes an implementation plan, and on explicit user confirmation writes the change, opens a PR from th

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	<upstream> → value of `upstream_repo:` in <project-config>/project.md
5	Before running any bash command below, substitute these with the
6	concrete values from the adopting project's <project-config>/project.md. -->
7
8	# security-issue-fix
9
10	This skill automates the "attempt a fix" step of the security handling
11	process for issues in [`<tracker>`](https://github.com/<tracker>).
12	It composes with the [`security-issue-sync`](../security-issue-sync/SKILL.md)
13	skill — it always runs the sync first so that the issue's state is
14	reconciled with the mail thread and any existing PRs before attempting
15	any new work.
16
17	Golden rule: Every state-changing action — writing files in the
18	local `<upstream>` clone, committing, pushing to the user's fork,
19	opening a public PR, editing or commenting on `<tracker>`,
20	drafting mail on the `security@` thread — is a proposal that requires
21	explicit confirmation from the user before it runs. The fact that the
22	user invoked the skill is not a blanket "yes". In particular, **nothing
23	public is pushed without the user explicitly approving the exact PR
24	title, body and diff first.**
25
26	Confidentiality is paramount. The resulting PR in `<upstream>`
27	is public to the world. It must not reveal the CVE ID, the security
28	nature of the change, or any link back to `<tracker>` — **and it
29	must not name, reference, or describe vulnerabilities in other ASF
30	projects**, even when the private discussion has mentioned them.
31	See the "Confidentiality of `<tracker>`" section of
32	[`AGENTS.md`](../../AGENTS.md) and the "Other ASF projects —
33	never name or describe their vulnerabilities" subsection
34	immediately below it, plus process step 8 of
35	[`README.md`](../../README.md).
36
37	**Golden rule — every `<tracker>` / `<upstream>` reference is
38	clickable in the surface it lands on.** Whenever this skill emits
39	a reference to a tracker issue, the public fix PR, or a sibling
40	PR / commit — the implementation plan shown to the user, the
41	public PR body / commit message destined for `<upstream>`, the
42	status-rollup update on the private `<tracker>` issue, the recap
43	output — the reference must be one click away in whatever surface
44	it lands on:
45
46	- On markdown surfaces (the public PR body and commit
47	messages destined for `<upstream>`; the status-rollup update on
48	`<tracker>`): use the markdown link form per
49	[`AGENTS.md` § Linking tracker issues and PRs](../../AGENTS.md#linking-tracker-issues-and-prs):
50	- `<upstream>` PR: `[<upstream>#NNN](https://github.com/<upstream>/pull/NNN)`
51	- `<tracker>` issue (only in the status-rollup update on
52	`<tracker>` itself — never in the public PR body, where the
53	private tracker URL has no place): `[<tracker>#NNN](https://github.com/<tracker>/issues/NNN)`
54	- Commit: `[<sha>](https://github.com/<upstream>/commit/<sha>)`
55
56	- On terminal surfaces (the implementation-plan proposal, the
57	apply-loop progress lines, the recap): wrap the visible short
58	form in OSC 8 hyperlink escape sequences
59	(`\e]8;;<URL>\e\\<short>\e]8;;\e\\`) so modern terminals
60	render the number itself as clickable. Where OSC 8 is
61	unsupported (CI logs, dumb terminals), fall back to printing
62	the bare URL on the same line after the number.
63
64	Bare `#NNN` with no link wrapper of any kind is never acceptable.
65	Cross-confidentiality reminder: the existing confidentiality
66	scrub forbids the `<tracker>` URL from appearing in `<upstream>`
67	PR content — clickable rendering does not change that boundary.
68
69	**Self-check before pushing the public PR or posting to
70	`<tracker>`**: grep the body fo

People who liked this also viewed

6 picks

Type

security-issue-fix

68stars52forks

View on GitHub

How to install security-issue-fix?

apache/magpie/security-issue-fix

$npx -y skills add apache/magpie --skill security-issue-fix

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	<upstream> → value of `upstream_repo:` in <project-config>/project.md
5	Before running any bash command below, substitute these with the
6	concrete values from the adopting project's <project-config>/project.md. -->
7
8	# security-issue-fix
9
10	This skill automates the "attempt a fix" step of the security handling
11	process for issues in [`<tracker>`](https://github.com/<tracker>).
12	It composes with the [`security-issue-sync`](../security-issue-sync/SKILL.md)
13	skill — it always runs the sync first so that the issue's state is
14	reconciled with the mail thread and any existing PRs before attempting
15	any new work.
16
17	Golden rule: Every state-changing action — writing files in the
18	local `<upstream>` clone, committing, pushing to the user's fork,
19	opening a public PR, editing or commenting on `<tracker>`,
20	drafting mail on the `security@` thread — is a proposal that requires
21	explicit confirmation from the user before it runs. The fact that the
22	user invoked the skill is not a blanket "yes". In particular, **nothing
23	public is pushed without the user explicitly approving the exact PR
24	title, body and diff first.**
25
26	Confidentiality is paramount. The resulting PR in `<upstream>`
27	is public to the world. It must not reveal the CVE ID, the security
28	nature of the change, or any link back to `<tracker>` — **and it
29	must not name, reference, or describe vulnerabilities in other ASF
30	projects**, even when the private discussion has mentioned them.
31	See the "Confidentiality of `<tracker>`" section of
32	[`AGENTS.md`](../../AGENTS.md) and the "Other ASF projects —
33	never name or describe their vulnerabilities" subsection
34	immediately below it, plus process step 8 of
35	[`README.md`](../../README.md).
36
37	**Golden rule — every `<tracker>` / `<upstream>` reference is
38	clickable in the surface it lands on.** Whenever this skill emits
39	a reference to a tracker issue, the public fix PR, or a sibling
40	PR / commit — the implementation plan shown to the user, the
41	public PR body / commit message destined for `<upstream>`, the
42	status-rollup update on the private `<tracker>` issue, the recap
43	output — the reference must be one click away in whatever surface
44	it lands on:
45
46	- On markdown surfaces (the public PR body and commit
47	messages destined for `<upstream>`; the status-rollup update on
48	`<tracker>`): use the markdown link form per
49	[`AGENTS.md` § Linking tracker issues and PRs](../../AGENTS.md#linking-tracker-issues-and-prs):
50	- `<upstream>` PR: `[<upstream>#NNN](https://github.com/<upstream>/pull/NNN)`
51	- `<tracker>` issue (only in the status-rollup update on
52	`<tracker>` itself — never in the public PR body, where the
53	private tracker URL has no place): `[<tracker>#NNN](https://github.com/<tracker>/issues/NNN)`
54	- Commit: `[<sha>](https://github.com/<upstream>/commit/<sha>)`
55
56	- On terminal surfaces (the implementation-plan proposal, the
57	apply-loop progress lines, the recap): wrap the visible short
58	form in OSC 8 hyperlink escape sequences
59	(`\e]8;;<URL>\e\\<short>\e]8;;\e\\`) so modern terminals
60	render the number itself as clickable. Where OSC 8 is
61	unsupported (CI logs, dumb terminals), fall back to printing
62	the bare URL on the same line after the number.
63
64	Bare `#NNN` with no link wrapper of any kind is never acceptable.
65	Cross-confidentiality reminder: the existing confidentiality
66	scrub forbids the `<tracker>` URL from appearing in `<upstream>`
67	PR content — clickable rendering does not change that boundary.
68
69	**Self-check before pushing the public PR or posting to
70	`<tracker>`**: grep the body fo

People who liked this also viewed

6 picks

Type