security-issue-import

Name: security-issue-import
Author: apache

68stars52forks

How to install security-issue-import?

apache/magpie/security-issue-import

$npx -y skills add apache/magpie --skill security-issue-import

Installs into the current project.

Summary

Scan <security-list> for reports that have not yet been copied into <tracker> as tracking issues, present the proposed imports to the user, and — defaulting to *import unless the user rejects upfront* — create the tracking issues with the Needs triage project-board status and d

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	<upstream> → value of `upstream_repo:` in <project-config>/project.md
5	Before running any bash command below, substitute these with the
6	concrete values from the adopting project's <project-config>/project.md. -->
7
8	# security-issue-import
9
10	This skill is the on-ramp of the security-issue handling process.
11	It converts an inbound `<security-list>` email thread into
12	an `<tracker>` tracking issue that follows the repo's issue
13	template, then drafts the receipt-of-confirmation reply to the reporter.
14
15	It never sends email. It never creates a tracker for a candidate the
16	user has explicitly rejected. It never assumes a report is valid —
17	the validity / invalid / CVE-worthy decision still happens later in
18	the discussion on the created tracker (Step 3 of
19	[`README.md`](../../README.md)).
20
21	Golden rule — propose, then default to import. Every import this
22	skill performs is a proposal that lists the candidate emails, the
23	extracted fields, and the draft confirmation reply. The user's
24	default disposition for any `Report` or forwarder-relayed
25	candidate (the latter classified by the optional
26	[`security-issue-import-via-forwarder`](../security-issue-import-via-forwarder/SKILL.md)
27	sub-skill when `forwarders.enabled` is non-empty) is
28	"import as a new tracker landing in `Needs triage`";
29	the user only has to type back when they want to deviate from that
30	default — `skip NN` to reject a candidate upfront with no reply, or
31	`NN:reject-with-canned <name>` to reject upfront and draft a
32	specific canned negative-assessment / out-of-scope reply. A bare
33	`all` (or no reply at all to the proposal — the user typing
34	"go", "proceed", "yes, all") means *"import every
35	non-rejected candidate as proposed"*. The skill must still surface
36	each candidate one-by-one in the proposal so the user can scan and
37	override if needed; what the skill must not do is sit on a report
38	waiting for an explicit per-candidate green light. The bias is
39	toward landing trackers — a wrongly-imported report is cheap to
40	close at Step 5 / 6 of the handling process; a wrongly-skipped one
41	gets buried in the inbox and the reporter is left without a
42	disposition.
43
44	Golden rule — rejection means no tracker, ever. When the user
45	rejects a candidate upfront — any of `skip NN`,
46	`NN:reject-with-canned <name>`, an explicit "reject 1",
47	"mark 1 invalid", "don't import 1", or a `cancel` / `none` /
48	"hold off" on the whole proposal — the skill must not create
49	a tracker for that candidate. This holds even when the user also
50	asks for a canned reply to be drafted: the draft is a courtesy to
51	the reporter, the absence of a tracker is the disposition. There is
52	no "create the tracker so the team can close it as invalid later"
53	path; if the team has decided pre-triage that the report is
54	invalid, the audit trail lives on the Gmail thread and on the
55	`canned-responses.md` precedent, not in a tracker that exists only
56	to be closed. A tracker is created only when the candidate is
57	imported as a real `Report` (or a forwarder-relayed candidate
58	classified by the
59	[`security-issue-import-via-forwarder`](../security-issue-import-via-forwarder/SKILL.md)
60	sub-skill) for triage.
61
62	Non-import candidate classes (`automated-scanner`,
63	`consolidated-multi-issue`, `media-request`, `spam`,
64	`cross-thread-followup`, `

People who liked this also viewed

6 picks

Type

security-issue-import

68stars52forks

View on GitHub

How to install security-issue-import?

apache/magpie/security-issue-import

$npx -y skills add apache/magpie --skill security-issue-import

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	<upstream> → value of `upstream_repo:` in <project-config>/project.md
5	Before running any bash command below, substitute these with the
6	concrete values from the adopting project's <project-config>/project.md. -->
7
8	# security-issue-import
9
10	This skill is the on-ramp of the security-issue handling process.
11	It converts an inbound `<security-list>` email thread into
12	an `<tracker>` tracking issue that follows the repo's issue
13	template, then drafts the receipt-of-confirmation reply to the reporter.
14
15	It never sends email. It never creates a tracker for a candidate the
16	user has explicitly rejected. It never assumes a report is valid —
17	the validity / invalid / CVE-worthy decision still happens later in
18	the discussion on the created tracker (Step 3 of
19	[`README.md`](../../README.md)).
20
21	Golden rule — propose, then default to import. Every import this
22	skill performs is a proposal that lists the candidate emails, the
23	extracted fields, and the draft confirmation reply. The user's
24	default disposition for any `Report` or forwarder-relayed
25	candidate (the latter classified by the optional
26	[`security-issue-import-via-forwarder`](../security-issue-import-via-forwarder/SKILL.md)
27	sub-skill when `forwarders.enabled` is non-empty) is
28	"import as a new tracker landing in `Needs triage`";
29	the user only has to type back when they want to deviate from that
30	default — `skip NN` to reject a candidate upfront with no reply, or
31	`NN:reject-with-canned <name>` to reject upfront and draft a
32	specific canned negative-assessment / out-of-scope reply. A bare
33	`all` (or no reply at all to the proposal — the user typing
34	"go", "proceed", "yes, all") means *"import every
35	non-rejected candidate as proposed"*. The skill must still surface
36	each candidate one-by-one in the proposal so the user can scan and
37	override if needed; what the skill must not do is sit on a report
38	waiting for an explicit per-candidate green light. The bias is
39	toward landing trackers — a wrongly-imported report is cheap to
40	close at Step 5 / 6 of the handling process; a wrongly-skipped one
41	gets buried in the inbox and the reporter is left without a
42	disposition.
43
44	Golden rule — rejection means no tracker, ever. When the user
45	rejects a candidate upfront — any of `skip NN`,
46	`NN:reject-with-canned <name>`, an explicit "reject 1",
47	"mark 1 invalid", "don't import 1", or a `cancel` / `none` /
48	"hold off" on the whole proposal — the skill must not create
49	a tracker for that candidate. This holds even when the user also
50	asks for a canned reply to be drafted: the draft is a courtesy to
51	the reporter, the absence of a tracker is the disposition. There is
52	no "create the tracker so the team can close it as invalid later"
53	path; if the team has decided pre-triage that the report is
54	invalid, the audit trail lives on the Gmail thread and on the
55	`canned-responses.md` precedent, not in a tracker that exists only
56	to be closed. A tracker is created only when the candidate is
57	imported as a real `Report` (or a forwarder-relayed candidate
58	classified by the
59	[`security-issue-import-via-forwarder`](../security-issue-import-via-forwarder/SKILL.md)
60	sub-skill) for triage.
61
62	Non-import candidate classes (`automated-scanner`,
63	`consolidated-multi-issue`, `media-request`, `spam`,
64	`cross-thread-followup`, `

People who liked this also viewed

6 picks

Type