security-issue-import-via-forwarder

Name: security-issue-import-via-forwarder
Author: apache

68stars52forks

How to install security-issue-import-via-forwarder?

apache/magpie/security-issue-import-via-forwarder

$npx -y skills add apache/magpie --skill security-issue-import-via-forwarder

Installs into the current project.

Summary

Optional sub-skill of security-issue-import, security-issue-invalidate, and security-issue-sync that handles the *relay/forwarder* case: a report that did not arrive directly from the reporter but was relayed onto <security-list> by an upstream broker (the ASF security te

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	(example: `<tracker>`)
5	<upstream> → value of `upstream_repo:` in <project-config>/project.md
6	(example: `<upstream>`)
7	<security-list> → value of `security_list:` in <project-config>/project.md
8	(example: `<security-list>`)
9	<security-list-domain> → host portion of <security-list>
10	(example: host of `<security-list>`)
11	Before running any bash command below, substitute these with the
12	concrete values from the adopting project's <project-config>/project.md. -->
13
14	# security-issue-import-via-forwarder
15
16	This skill is the forwarder-aware extension of the security-
17	issue import / invalidate / sync flow. It does not duplicate the
18	parent skills' classification logic; it specialises the small
19	slice of behaviour that differs when the inbound message is a
20	relay — sent by a broker on behalf of the original reporter —
21	rather than a direct report from the reporter themselves.
22
23	The contract this skill consumes is documented in
24	[`tools/forwarder-relay/README.md`](../../tools/forwarder-relay/README.md).
25	The adapters enabled for the current adopter are declared in
26	[`<project-config>/project.md → forwarders.enabled`](../../<project-config>/project.md#forwarders).
27	The skill body below is adapter-agnostic: every adapter-
28	specific value (sender pattern, preamble regex, credit-extraction
29	rule, contact handle, reporter-addressing-block wrapper shape) is
30	read from config and the matching adapter's reference doc, never
31	hard-coded here.
32
33	When invoked, the skill:
34
35	1. Confirms at least one forwarder adapter is registered for the
36	current adopter (the pre-flight check below).
37	2. Dispatches the in-hand inbound message through each registered
38	adapter's `detect()` operation, in the order declared under
39	`forwarders.enabled`.
40	3. On the first non-null detect, applies the matched adapter's
41	credit extraction to the message body and renders the reporter-
42	addressing block per the adapter's `reporter_addressing_block()`
43	convention.
44	4. Hands the extracted credit + routing decision back to the parent
45	skill, which folds the values into its proposal table and waits
46	for explicit user confirmation before applying any state
47	mutation.
48
49	Golden rule — propose, never apply. This skill is a
50	classification + routing helper. It never creates a tracker
51	issue, never sends a draft, never edits a body field on its own.
52	Every state-mutating proposal it produces is handed back to the
53	parent skill, which surfaces it to the user under the parent's
54	own confirmation contract (the "propose, then default to import"
55	golden rule in
56	[`security-issue-import`](../security-issue-import/SKILL.md), the
57	"close-as-invalid only on explicit confirmation" rule in
58	[`security-issue-invalidate`](../security-issue-invalidate/SKILL.md),
59	and so on). A relay-routing decision applied without user
60	confirmation would bypass exactly the trust gate the framework's
61	load-bearing skills are built around.
62
63	Golden rule — adapter-agnostic body. The skill body must not
64	hard-code behaviour for any specific adapter. Adapters are
65	referenced only through `forwarders.enabled` (the default
66	`asf-security`, plus any further adapters an adopter registers).
67	Every reference to adapter be

People who liked this also viewed

6 picks

Type

security-issue-import-via-forwarder

68stars52forks

View on GitHub

How to install security-issue-import-via-forwarder?

apache/magpie/security-issue-import-via-forwarder

$npx -y skills add apache/magpie --skill security-issue-import-via-forwarder

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	(example: `<tracker>`)
5	<upstream> → value of `upstream_repo:` in <project-config>/project.md
6	(example: `<upstream>`)
7	<security-list> → value of `security_list:` in <project-config>/project.md
8	(example: `<security-list>`)
9	<security-list-domain> → host portion of <security-list>
10	(example: host of `<security-list>`)
11	Before running any bash command below, substitute these with the
12	concrete values from the adopting project's <project-config>/project.md. -->
13
14	# security-issue-import-via-forwarder
15
16	This skill is the forwarder-aware extension of the security-
17	issue import / invalidate / sync flow. It does not duplicate the
18	parent skills' classification logic; it specialises the small
19	slice of behaviour that differs when the inbound message is a
20	relay — sent by a broker on behalf of the original reporter —
21	rather than a direct report from the reporter themselves.
22
23	The contract this skill consumes is documented in
24	[`tools/forwarder-relay/README.md`](../../tools/forwarder-relay/README.md).
25	The adapters enabled for the current adopter are declared in
26	[`<project-config>/project.md → forwarders.enabled`](../../<project-config>/project.md#forwarders).
27	The skill body below is adapter-agnostic: every adapter-
28	specific value (sender pattern, preamble regex, credit-extraction
29	rule, contact handle, reporter-addressing-block wrapper shape) is
30	read from config and the matching adapter's reference doc, never
31	hard-coded here.
32
33	When invoked, the skill:
34
35	1. Confirms at least one forwarder adapter is registered for the
36	current adopter (the pre-flight check below).
37	2. Dispatches the in-hand inbound message through each registered
38	adapter's `detect()` operation, in the order declared under
39	`forwarders.enabled`.
40	3. On the first non-null detect, applies the matched adapter's
41	credit extraction to the message body and renders the reporter-
42	addressing block per the adapter's `reporter_addressing_block()`
43	convention.
44	4. Hands the extracted credit + routing decision back to the parent
45	skill, which folds the values into its proposal table and waits
46	for explicit user confirmation before applying any state
47	mutation.
48
49	Golden rule — propose, never apply. This skill is a
50	classification + routing helper. It never creates a tracker
51	issue, never sends a draft, never edits a body field on its own.
52	Every state-mutating proposal it produces is handed back to the
53	parent skill, which surfaces it to the user under the parent's
54	own confirmation contract (the "propose, then default to import"
55	golden rule in
56	[`security-issue-import`](../security-issue-import/SKILL.md), the
57	"close-as-invalid only on explicit confirmation" rule in
58	[`security-issue-invalidate`](../security-issue-invalidate/SKILL.md),
59	and so on). A relay-routing decision applied without user
60	confirmation would bypass exactly the trust gate the framework's
61	load-bearing skills are built around.
62
63	Golden rule — adapter-agnostic body. The skill body must not
64	hard-code behaviour for any specific adapter. Adapters are
65	referenced only through `forwarders.enabled` (the default
66	`asf-security`, plus any further adapters an adopter registers).
67	Every reference to adapter be

People who liked this also viewed

6 picks

Type