security-issue-invalidate

Name: security-issue-invalidate
Author: apache

68stars52forks

How to install security-issue-invalidate?

apache/magpie/security-issue-invalidate

$npx -y skills add apache/magpie --skill security-issue-invalidate

Installs into the current project.

Summary

Close an <tracker> tracking issue as invalid: apply the invalid label, remove the scope label, post a short closing comment, archive the item from the project board, and — for trackers imported from <security-list> — draft a polite-but-firm reply to the reporter on the orig

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	<upstream> → value of `upstream_repo:` in <project-config>/project.md
5	<cve-tool> → adapter directory under `tools/` named by
6	`cve_authority.tool:` in <project-config>/project.md
7	(example: cve-tool-vulnogram when `tool: vulnogram`,
8	i.e. the ASF default that resolves to
9	`tools/cve-tool-vulnogram/`).
10	Before running any bash command below, substitute these with the
11	concrete values from the adopting project's <project-config>/project.md. -->
12
13	# security-issue-invalidate
14
15	This skill is the terminal-disposition apply step for the
16	`invalid` close on an `<tracker>` tracker. It does not host the
17	discussion that decides invalidity — that happens at Step 5 of the
18	[handling process](../../docs/security/process.md#step-5--land-the-validinvalid-consensus)
19	in the tracker's comments. Once the team has reached a
20	consensus-invalid decision, this skill applies it: labels the
21	tracker `invalid`, posts a short public-facing closing comment,
22	closes the tracker, archives the project-board item, and (for
23	`security@`-imported trackers) drafts a reply to the reporter
24	explaining why.
25
26	It is the symmetric counterpart of
27	[`security-cve-allocate`](../security-cve-allocate/SKILL.md) (apply step for the
28	valid → CVE path). Both skills assume the validity decision has
29	already been reached; they wire that decision into the tracker
30	state in one pass.
31
32	Golden rule — never sends email. Any reply to the reporter is
33	created as a Gmail draft on the original inbound thread. The
34	triager reviews the draft in Gmail before sending. The skill must
35	not call `send` on any drafting backend.
36
37	Golden rule — public-facing comment is brief. The closing
38	comment posted on the public-by-collaborator-access tracker is
39	short and process-shaped (*"closing as invalid per team consensus
40	in this thread"*); the team's full reasoning lives in the
41	discussion comments and the rollup. The detailed reasoning belongs
42	in the email draft to the reporter (where it actually serves a
43	purpose), not in a closing comment that re-packages the same
44	material.
45
46	Golden rule — no outreach to PR-imported tracker authors. When
47	the tracker came in via
48	[`security-issue-import-from-pr`](../security-issue-import-from-pr/SKILL.md)
49	(detected by the `N/A — opened from public PR …` sentinel in the
50	Security mailing list thread body field), there is no reporter
51	to notify — the PR author is not the CVE reporter and the public
52	PR stays unaware of the CVE process per that skill's policy. Skip
53	the email-draft step entirely; do not comment on the public PR;
54	do not reach out to the PR author through any channel.
55
56	**Golden rule — every `<tracker>` / `<upstream>` reference is
57	clickable in the surface it lands on.** Whenever this skill emits
58	a reference to the tracker issue, a sibling tracker, or any
59	cited PR — the closing comment posted on the tracker, the
60	draft email reply to the reporter on the `<security-list>`
61	thread, the recap output — the reference must be one click away
62	in whatever surface it lands on:
63
64	- On markdown surfaces (the closing comment posted to
65	`<tracker>`, the draft email reply text destined for the
66	`<security-list>` Gmail thread): use the markdown link form
67	per
68	[`AGENTS.md` § Linking tracker issues and PRs](../../AGENTS.md#linking-tracker-issues-and-prs):
69	- `<tracker>` issue: `[<tracker>#NNN](https://github

People who liked this also viewed

6 picks

Type

security-issue-invalidate

68stars52forks

View on GitHub

How to install security-issue-invalidate?

apache/magpie/security-issue-invalidate

$npx -y skills add apache/magpie --skill security-issue-invalidate

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	<upstream> → value of `upstream_repo:` in <project-config>/project.md
5	<cve-tool> → adapter directory under `tools/` named by
6	`cve_authority.tool:` in <project-config>/project.md
7	(example: cve-tool-vulnogram when `tool: vulnogram`,
8	i.e. the ASF default that resolves to
9	`tools/cve-tool-vulnogram/`).
10	Before running any bash command below, substitute these with the
11	concrete values from the adopting project's <project-config>/project.md. -->
12
13	# security-issue-invalidate
14
15	This skill is the terminal-disposition apply step for the
16	`invalid` close on an `<tracker>` tracker. It does not host the
17	discussion that decides invalidity — that happens at Step 5 of the
18	[handling process](../../docs/security/process.md#step-5--land-the-validinvalid-consensus)
19	in the tracker's comments. Once the team has reached a
20	consensus-invalid decision, this skill applies it: labels the
21	tracker `invalid`, posts a short public-facing closing comment,
22	closes the tracker, archives the project-board item, and (for
23	`security@`-imported trackers) drafts a reply to the reporter
24	explaining why.
25
26	It is the symmetric counterpart of
27	[`security-cve-allocate`](../security-cve-allocate/SKILL.md) (apply step for the
28	valid → CVE path). Both skills assume the validity decision has
29	already been reached; they wire that decision into the tracker
30	state in one pass.
31
32	Golden rule — never sends email. Any reply to the reporter is
33	created as a Gmail draft on the original inbound thread. The
34	triager reviews the draft in Gmail before sending. The skill must
35	not call `send` on any drafting backend.
36
37	Golden rule — public-facing comment is brief. The closing
38	comment posted on the public-by-collaborator-access tracker is
39	short and process-shaped (*"closing as invalid per team consensus
40	in this thread"*); the team's full reasoning lives in the
41	discussion comments and the rollup. The detailed reasoning belongs
42	in the email draft to the reporter (where it actually serves a
43	purpose), not in a closing comment that re-packages the same
44	material.
45
46	Golden rule — no outreach to PR-imported tracker authors. When
47	the tracker came in via
48	[`security-issue-import-from-pr`](../security-issue-import-from-pr/SKILL.md)
49	(detected by the `N/A — opened from public PR …` sentinel in the
50	Security mailing list thread body field), there is no reporter
51	to notify — the PR author is not the CVE reporter and the public
52	PR stays unaware of the CVE process per that skill's policy. Skip
53	the email-draft step entirely; do not comment on the public PR;
54	do not reach out to the PR author through any channel.
55
56	**Golden rule — every `<tracker>` / `<upstream>` reference is
57	clickable in the surface it lands on.** Whenever this skill emits
58	a reference to the tracker issue, a sibling tracker, or any
59	cited PR — the closing comment posted on the tracker, the
60	draft email reply to the reporter on the `<security-list>`
61	thread, the recap output — the reference must be one click away
62	in whatever surface it lands on:
63
64	- On markdown surfaces (the closing comment posted to
65	`<tracker>`, the draft email reply text destined for the
66	`<security-list>` Gmail thread): use the markdown link form
67	per
68	[`AGENTS.md` § Linking tracker issues and PRs](../../AGENTS.md#linking-tracker-issues-and-prs):
69	- `<tracker>` issue: `[<tracker>#NNN](https://github

People who liked this also viewed

6 picks

Type