security-issue-import-from-scan

Name: security-issue-import-from-scan
Author: apache

68stars52forks

How to install security-issue-import-from-scan?

apache/magpie/security-issue-import-from-scan

$npx -y skills add apache/magpie --skill security-issue-import-from-scan

Installs into the current project.

Summary

Triage a security scanner's multi-finding output (read via a pluggable scan-format adapter) and turn findings into security work only after a complete operator-reviewed triage. Reads the scan's finding index plus its per-finding evidence; buckets each finding by disposition; appl

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → `tracker_repo:` in <project-config>/project.md
4	<upstream> → `upstream_repo:` in <project-config>/project.md
5	<scan-repo> → the public repository the scan reports live in
6	(declared in <project-config>/project.md → scan sources)
7	<scan-format> → adapter under `tools/scan-format/` named by the
8	project's enabled scan formats (reference: `asvs`) -->
9
10	# security-issue-import-from-scan
11
12	This skill is the scanner on-ramp of the security-issue handling
13	process. It converts a security scanner's multi-finding output into
14	security work — but, unlike the human-report on-ramps, it **never
15	defaults to import**. A scan emits dozens of machine-generated findings,
16	most of which are by-design, already-fixed, or below the CVE bar for the
17	project's threat model. So the first-pass deliverable is a **triage
18	report**; any tracker or PR is opt-in per the operator's reviewed
19	decision.
20
21	It composes with:
22
23	- [`security-issue-import`](../security-issue-import/SKILL.md) — the
24	Gmail on-ramp; this skill reuses its Step 2a fuzzy-dup search, its
25	reject-pattern check, and its Step 7 tracker-creation path.
26	- [`security-issue-triage`](../security-issue-triage/SKILL.md) — whose
27	Security-Model trust-boundary cheat-sheet and closed-invalid /
28	positive-precedent searches do the actual classification.
29	- [`security-issue-fix`](../security-issue-fix/SKILL.md) — where a
30	confirmed PR-worth finding becomes a public hardening PR.
31
32	The scan-format details (how to parse a given scanner's index +
33	evidence, the finding schema) live behind a pluggable adapter at
34	[`tools/scan-format/`](../../tools/scan-format/README.md); ASVS is the
35	reference adapter. The project declares its scan sources and enabled
36	formats in [`<project-config>/project.md`](../../projects/_template/project.md).
37
38	## Golden rules
39
40	Golden rule 1 — triage-first, never auto-import. The first pass
41	always produces the report; trackers and PRs are opt-in. Do not create
42	any tracker, and do not open any PR, for a finding the operator has not
43	confirmed.
44
45	Golden rule 2 — never blindly trust the scanner; default to 1-by-1.
46	Scanner output systematically over-states severity and reachability, so
47	the disposition table is a starting hypothesis, not a verdict. Default
48	to a 1-by-1 review — present findings one at a time and let the
49	operator decide each — unless a set is cleanly groupable and the call
50	is obvious (an "already-fixed" cluster, a row of identical by-design
51	findings). Actively invite the operator to dig in: for any finding
52	they're unsure of, show the actual source code at the cited path, trace
53	the call sites and the real attacker / threat model, and check whether
54	the behaviour is reachable / already-mitigated / by-design — rather than
55	acting on the title. State this expectation explicitly when presenting
56	the report.
57
58	**Golden rule 3 — PR-worth / defense-in-depth findings NEVER become
59	trackers.** They are proposed per entry and the operator opens a public
60	PR or skips. A scanner-found, below-CVE-bar hardening does not belong in
61	the private security tracker. Only the import-as-tracker (CVE-worthy)
62	bucket — a genuine Security-Model violation reachable by an in-scope
63	attacker — creates a `<tracker>` issue.
64
65	Golden rule 4 — confidentiality and scrub. The triage discussion may
66	reference private `<tracker>` issues and unpublished CVEs internally, but
67	any public report surface — a gist (secret but link-shareable), a
68	rep

People who liked this also viewed

6 picks

Type

security-issue-import-from-scan

68stars52forks

View on GitHub

How to install security-issue-import-from-scan?

apache/magpie/security-issue-import-from-scan

$npx -y skills add apache/magpie --skill security-issue-import-from-scan

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → `tracker_repo:` in <project-config>/project.md
4	<upstream> → `upstream_repo:` in <project-config>/project.md
5	<scan-repo> → the public repository the scan reports live in
6	(declared in <project-config>/project.md → scan sources)
7	<scan-format> → adapter under `tools/scan-format/` named by the
8	project's enabled scan formats (reference: `asvs`) -->
9
10	# security-issue-import-from-scan
11
12	This skill is the scanner on-ramp of the security-issue handling
13	process. It converts a security scanner's multi-finding output into
14	security work — but, unlike the human-report on-ramps, it **never
15	defaults to import**. A scan emits dozens of machine-generated findings,
16	most of which are by-design, already-fixed, or below the CVE bar for the
17	project's threat model. So the first-pass deliverable is a **triage
18	report**; any tracker or PR is opt-in per the operator's reviewed
19	decision.
20
21	It composes with:
22
23	- [`security-issue-import`](../security-issue-import/SKILL.md) — the
24	Gmail on-ramp; this skill reuses its Step 2a fuzzy-dup search, its
25	reject-pattern check, and its Step 7 tracker-creation path.
26	- [`security-issue-triage`](../security-issue-triage/SKILL.md) — whose
27	Security-Model trust-boundary cheat-sheet and closed-invalid /
28	positive-precedent searches do the actual classification.
29	- [`security-issue-fix`](../security-issue-fix/SKILL.md) — where a
30	confirmed PR-worth finding becomes a public hardening PR.
31
32	The scan-format details (how to parse a given scanner's index +
33	evidence, the finding schema) live behind a pluggable adapter at
34	[`tools/scan-format/`](../../tools/scan-format/README.md); ASVS is the
35	reference adapter. The project declares its scan sources and enabled
36	formats in [`<project-config>/project.md`](../../projects/_template/project.md).
37
38	## Golden rules
39
40	Golden rule 1 — triage-first, never auto-import. The first pass
41	always produces the report; trackers and PRs are opt-in. Do not create
42	any tracker, and do not open any PR, for a finding the operator has not
43	confirmed.
44
45	Golden rule 2 — never blindly trust the scanner; default to 1-by-1.
46	Scanner output systematically over-states severity and reachability, so
47	the disposition table is a starting hypothesis, not a verdict. Default
48	to a 1-by-1 review — present findings one at a time and let the
49	operator decide each — unless a set is cleanly groupable and the call
50	is obvious (an "already-fixed" cluster, a row of identical by-design
51	findings). Actively invite the operator to dig in: for any finding
52	they're unsure of, show the actual source code at the cited path, trace
53	the call sites and the real attacker / threat model, and check whether
54	the behaviour is reachable / already-mitigated / by-design — rather than
55	acting on the title. State this expectation explicitly when presenting
56	the report.
57
58	**Golden rule 3 — PR-worth / defense-in-depth findings NEVER become
59	trackers.** They are proposed per entry and the operator opens a public
60	PR or skips. A scanner-found, below-CVE-bar hardening does not belong in
61	the private security tracker. Only the import-as-tracker (CVE-worthy)
62	bucket — a genuine Security-Model violation reachable by an in-scope
63	attacker — creates a `<tracker>` issue.
64
65	Golden rule 4 — confidentiality and scrub. The triage discussion may
66	reference private `<tracker>` issues and unpublished CVEs internally, but
67	any public report surface — a gist (secret but link-shareable), a
68	rep

People who liked this also viewed

6 picks

Type