security-issue-import-from-md

Name: security-issue-import-from-md
Author: apache

68stars52forks

How to install security-issue-import-from-md?

apache/magpie/security-issue-import-from-md

$npx -y skills add apache/magpie --skill security-issue-import-from-md

Installs into the current project.

Summary

Open one or more <tracker> tracking issues from a markdown file containing a batch of security findings. Each finding becomes one tracker landing in the Needs triage board column. The file itself is the full report — there is no inbound reporter to reply to and no PR to inspe

Files · 1

View on GitHub

SKILL.md

1	`. Typical sources:
2	AI security review output, third-party SAST report exported
3	as markdown, or a security consultant's findings document.
4	Skip when a single inbound report belongs on the Gmail path
5	(`security-issue-import`) or when there is a public PR to
6	anchor the import on (`security-issue-import-from-pr`).
7	argument-hint: "[path-to-markdown-file]"
8	capability: capability:intake
9	license: Apache-2.0
10	---
11
12	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
13	<project-config> → adopting project's `.apache-magpie/` directory
14	<tracker> → value of `tracker_repo:` in <project-config>/project.md
15	(example: `<tracker>`)
16	<upstream> → value of `upstream_repo:` in <project-config>/project.md
17	(example: `<upstream>`)
18	Before running any bash command below, substitute these with the
19	concrete values from the adopting project's <project-config>/project.md. -->
20
21	# security-issue-import-from-md
22
23	This skill is the batch on-ramp of the security-issue handling
24	process for the case where the security team has a markdown file
25	containing one or more pre-formatted security findings — typically
26	the output of an AI security review run against an `<upstream>`
27	branch, or a third-party scanner exporting in a similar shape. It
28	parses each finding in the file and creates one `<tracker>` tracking
29	issue per finding, landing them in `Needs triage` so the standard
30	validity discussion (Step 3 of [`README.md`](../../README.md))
31	can run.
32
33	It is the third on-ramp variant alongside the two existing import
34	skills:
35
36	\| \| `security-issue-import` \| `security-issue-import-from-pr` \| `security-issue-import-from-md` \|
37	\|---\|---\|---\|---\|
38	\| Source \| `<security-list>` Gmail / PonyMail thread \| `<upstream>` PR URL or number \| Markdown file with one or more findings \|
39	\| Reporter \| External researcher \| None (PR author = remediation developer) \| None (the file is the report; usually AI- or scanner-generated) \|
40	\| Receipt-of-confirmation reply \| Drafted on the inbound thread \| Skipped — no reporter to reply to \| Skipped — no reporter to reply to \|
41	\| Validity assessment \| Hosted on the tracker after import \| Already done informally before invocation \| Hosted on the tracker after import \|
42	\| Initial board column \| `Needs triage` \| `Assessed` \| `Needs triage` \|
43	\| Cardinality \| One thread → one tracker \| One PR → one tracker \| One file → N trackers \|
44
45	Golden rule — every finding lands as `Needs triage`. A
46	markdown file (especially an AI-generated one) is a proposal of
47	findings, not an assessment. Each tracker created by this skill
48	must go through the same Step 3 validity discussion as a Gmail-
49	imported tracker. The skill must not pre-assess findings based on
50	their `Severity:` tag, must not skip the validity step for
51	findings tagged `HIGH`, and must not auto-allocate CVEs.
52
53	Golden rule — confidentiality. The input markdown file is
54	private security-team material. Treat it the same as
55	`<security-list>` content per the
56	[Confidentiality of `<tracker>`](../../AGENTS.md#confidentiality-of-the-tracker-repository)
57	rule: paste verbatim into the (private) tracker is fine; never
58	paste into a public surface — not into `<upstream>`, not into a
59	public GHSA, not into any comment on a public repo. The `## Location`
60	URL fields commonly point at public branches / files; that is fine
61	to render as-is in the tracker (the URL is already public), but do
62	not propagate the surrounding security framing to the public
63	surface the URL points at.
64
65	Golden rule — propose every finding individually before applying.
66	Even when the input is a 50-finding file, the skill surfaces a
67	proposal table listing every finding and waits for explicit
68	confirmation. The default disposition mirrors `security-issue-import`:
69	import all unless rejected upfront (`skip N` to drop a specific
70	candidate). A bare `go` / `proceed` / `yes, all` imports every
71	non-rejected candidate. The skill must still render each candidate
72	in the proposal so the user can scan and override.
73
74	**Golden rule — every `<tracker>` / `<upstream>` reference is
75	clickable in the surface it lands on.** Whenever this skill emits
76	a reference to a tracker issue, PR, or comment — the proposal
77	table shown before

People who liked this also viewed

6 picks

Type

security-issue-import-from-md

68stars52forks

View on GitHub

How to install security-issue-import-from-md?

apache/magpie/security-issue-import-from-md

$npx -y skills add apache/magpie --skill security-issue-import-from-md

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	`. Typical sources:
2	AI security review output, third-party SAST report exported
3	as markdown, or a security consultant's findings document.
4	Skip when a single inbound report belongs on the Gmail path
5	(`security-issue-import`) or when there is a public PR to
6	anchor the import on (`security-issue-import-from-pr`).
7	argument-hint: "[path-to-markdown-file]"
8	capability: capability:intake
9	license: Apache-2.0
10	---
11
12	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
13	<project-config> → adopting project's `.apache-magpie/` directory
14	<tracker> → value of `tracker_repo:` in <project-config>/project.md
15	(example: `<tracker>`)
16	<upstream> → value of `upstream_repo:` in <project-config>/project.md
17	(example: `<upstream>`)
18	Before running any bash command below, substitute these with the
19	concrete values from the adopting project's <project-config>/project.md. -->
20
21	# security-issue-import-from-md
22
23	This skill is the batch on-ramp of the security-issue handling
24	process for the case where the security team has a markdown file
25	containing one or more pre-formatted security findings — typically
26	the output of an AI security review run against an `<upstream>`
27	branch, or a third-party scanner exporting in a similar shape. It
28	parses each finding in the file and creates one `<tracker>` tracking
29	issue per finding, landing them in `Needs triage` so the standard
30	validity discussion (Step 3 of [`README.md`](../../README.md))
31	can run.
32
33	It is the third on-ramp variant alongside the two existing import
34	skills:
35
36	\| \| `security-issue-import` \| `security-issue-import-from-pr` \| `security-issue-import-from-md` \|
37	\|---\|---\|---\|---\|
38	\| Source \| `<security-list>` Gmail / PonyMail thread \| `<upstream>` PR URL or number \| Markdown file with one or more findings \|
39	\| Reporter \| External researcher \| None (PR author = remediation developer) \| None (the file is the report; usually AI- or scanner-generated) \|
40	\| Receipt-of-confirmation reply \| Drafted on the inbound thread \| Skipped — no reporter to reply to \| Skipped — no reporter to reply to \|
41	\| Validity assessment \| Hosted on the tracker after import \| Already done informally before invocation \| Hosted on the tracker after import \|
42	\| Initial board column \| `Needs triage` \| `Assessed` \| `Needs triage` \|
43	\| Cardinality \| One thread → one tracker \| One PR → one tracker \| One file → N trackers \|
44
45	Golden rule — every finding lands as `Needs triage`. A
46	markdown file (especially an AI-generated one) is a proposal of
47	findings, not an assessment. Each tracker created by this skill
48	must go through the same Step 3 validity discussion as a Gmail-
49	imported tracker. The skill must not pre-assess findings based on
50	their `Severity:` tag, must not skip the validity step for
51	findings tagged `HIGH`, and must not auto-allocate CVEs.
52
53	Golden rule — confidentiality. The input markdown file is
54	private security-team material. Treat it the same as
55	`<security-list>` content per the
56	[Confidentiality of `<tracker>`](../../AGENTS.md#confidentiality-of-the-tracker-repository)
57	rule: paste verbatim into the (private) tracker is fine; never
58	paste into a public surface — not into `<upstream>`, not into a
59	public GHSA, not into any comment on a public repo. The `## Location`
60	URL fields commonly point at public branches / files; that is fine
61	to render as-is in the tracker (the URL is already public), but do
62	not propagate the surrounding security framing to the public
63	surface the URL points at.
64
65	Golden rule — propose every finding individually before applying.
66	Even when the input is a 50-finding file, the skill surfaces a
67	proposal table listing every finding and waits for explicit
68	confirmation. The default disposition mirrors `security-issue-import`:
69	import all unless rejected upfront (`skip N` to drop a specific
70	candidate). A bare `go` / `proceed` / `yes, all` imports every
71	non-rejected candidate. The skill must still render each candidate
72	in the proposal so the user can scan and override.
73
74	**Golden rule — every `<tracker>` / `<upstream>` reference is
75	clickable in the surface it lands on.** Whenever this skill emits
76	a reference to a tracker issue, PR, or comment — the proposal
77	table shown before

People who liked this also viewed

6 picks

Type