security-issue-import-from-pr
starsforks
How to install security-issue-import-from-pr?
apache/magpie/security-issue-import-from-pr
$npx -y skills add apache/magpie --skill security-issue-import-from-prOpen a tracking issue in <tracker> for a security-relevant fix that has already been opened (or merged) as a public PR in <upstream>, in the case where there is no inbound <security-list> report. The tracker lands in the Assessed board column with the scope label applied, `pr
SKILL.md
| 1 | <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files): |
| 2 | <project-config> → adopting project's `.apache-magpie/` directory |
| 3 | <tracker> → value of `tracker_repo:` in <project-config>/project.md |
| 4 | <upstream> → value of `upstream_repo:` in <project-config>/project.md |
| 5 | Before running any bash command below, substitute these with the |
| 6 | concrete values from the adopting project's <project-config>/project.md. --> |
| 7 | |
| 8 | # security-issue-import-from-pr |
| 9 | |
| 10 | This skill is an alternative on-ramp of the security-issue handling |
| 11 | process for the case where the report **never arrived on |
| 12 | `<security-list>`**. A contributor opened a public fix |
| 13 | in `<upstream>`; somebody on the security team noticed it is |
| 14 | security-relevant; the team decided informally that the fix |
| 15 | warrants a CVE. This skill turns that public PR into an |
| 16 | `<tracker>` tracking issue so the rest of the workflow |
| 17 | (`security-cve-allocate` → `security-issue-sync` → `security-issue-fix` → |
| 18 | public advisory) can run. |
| 19 | |
| 20 | It is the smaller sibling of [`security-issue-import`](../security-issue-import/SKILL.md): |
| 21 | |
| 22 | | | `security-issue-import` | `security-issue-import-from-pr` | |
| 23 | |---|---|---| |
| 24 | | Source | `<security-list>` Gmail / PonyMail thread | `<upstream>` PR URL or number | |
| 25 | | Reporter present | Yes (external researcher) | No (PR author = remediation developer = de-facto finder) | |
| 26 | | Receipt-of-confirmation reply | Drafted on the inbound thread | Skipped — no reporter to reply to | |
| 27 | | Inbound confidentiality | Report content is private; never leaks to public | PR is already public; no new private info to protect | |
| 28 | | Validity discussion | Hosted on the tracker after import (Step 3 of `README.md`) | Already done informally before invocation; tracker lands `Assessed` | |
| 29 | | Initial board column | `Needs triage` | `Assessed` | |
| 30 | |
| 31 | **Golden rule — `Assessed`, not `Needs triage`.** When the team |
| 32 | deliberately imports from a public PR, they have already concluded |
| 33 | that the report is a security issue. The tracker therefore skips |
| 34 | the `Needs triage` column and the validity discussion that |
| 35 | column implies; it lands in `Assessed` with the scope label |
| 36 | applied, ready for CVE allocation. Only invoke this skill once |
| 37 | that informal assessment has happened — if the report's security |
| 38 | relevance is genuinely unclear, route it through the normal |
| 39 | process (a brief discussion in security team chat, then either |
| 40 | import via `security@` if a reporter is involved, or open a |
| 41 | `Needs triage` tracker manually). |
| 42 | |
| 43 | **Golden rule — never reveal the security framing in `<upstream>`.** |
| 44 | The PR exists in public. The security team's interpretation of it |
| 45 | (severity, exploit path, CVE intent) does **not** until the |
| 46 | advisory ships. After this skill runs, do not characterise the |
| 47 | public PR as a security fix, do not comment on it with the CVE |
| 48 | plan, and do not paste tracker discussion content into it. The |
| 49 | tracker URL itself is a public-safe identifier per the |
| 50 | [Confidentiality of `<tracker>`](../../AGENTS.md#confidentiality-of-the-tracker-repository) |
| 51 | rule and may appear in the public PR description as a |
| 52 | cross-reference, **so long as the surrounding text does not frame |
| 53 | the change as a security fix**. The |
| 54 | [`security-issue-fix`](../security-issue-fix/SKILL.md) public-PR |
| 55 | guardrails apply in full from the moment the tracker exists: |
| 56 | neutral bug-fix language, no `CVE-`, no *"vulnerability"* or |
| 57 | *"security fix"* phrasing. |
| 58 | |
| 59 | **Golden rule — every `<tracker>` / `<upstream>` reference is |
| 60 | clickable in the surface it lands on.** Whenever this skill emits |
| 61 | a reference to a tracker issue, the source PR, or any sibling |
| 62 | PR / commit — the proposal shown before import, the created |
| 63 | tracker issue body (which records the source `<upstream>#NNN`, |
| 64 | the `Remediati |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
