security-issue-sync
starsforks
How to install security-issue-sync?
apache/magpie/security-issue-sync
$npx -y skills add apache/magpie --skill security-issue-syncSynchronize a security issue in <tracker> with the state of its GitHub discussion, the <security-list> mailing thread, and any <upstream> PRs that fix it. The skill gathers all relevant signals and proposes label / milestone / assignee / field / draft-email updates — applying onl
SKILL.md
| 1 | <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files): |
| 2 | <project-config> → adopting project's `.apache-magpie/` directory |
| 3 | <tracker> → value of `tracker_repo:` in <project-config>/project.md |
| 4 | <upstream> → value of `upstream_repo:` in <project-config>/project.md |
| 5 | <cve-tool> → adapter directory under `tools/` named by |
| 6 | `cve_authority.tool:` in <project-config>/project.md |
| 7 | (example: cve-tool-vulnogram when `tool: vulnogram`, |
| 8 | i.e. the ASF default that resolves to |
| 9 | `tools/cve-tool-vulnogram/`). |
| 10 | Before running any bash command below, substitute these with the |
| 11 | concrete values from the adopting project's <project-config>/project.md. --> |
| 12 | |
| 13 | # security-issue-sync |
| 14 | |
| 15 | This skill reconciles a single security issue in |
| 16 | [`<tracker>`](https://github.com/<tracker>) with: |
| 17 | |
| 18 | 1. the **GitHub issue** itself — comments, labels, milestone, assignee, description fields; |
| 19 | 2. the **email thread** on `<security-list>` that originated the report (and any follow-ups); |
| 20 | 3. any **pull requests** in `<upstream>` or `<tracker>` that reference or fix the issue; |
| 21 | 4. the **handling process** documented in [`README.md`](../../README.md). |
| 22 | |
| 23 | **Golden rule 1 — propose before applying.** Every change this skill |
| 24 | performs is a *proposal*. The user running the sync must explicitly |
| 25 | confirm each update before it is applied. Do not mutate GitHub state, do |
| 26 | not send email, do not create, close, or edit anything without a clear |
| 27 | "yes" from the user for that specific action. Drafts are always created |
| 28 | as Gmail **drafts**, never sent directly. |
| 29 | |
| 30 | **Golden rule 2 — every `<tracker>` reference is clickable in the |
| 31 | surface it lands on.** Whenever this skill mentions the tracking |
| 32 | issue, any other `<tracker>` issue, a `<tracker>` PR, a specific |
| 33 | issue comment, a milestone, or a label from this repository — in |
| 34 | the observed-state dump, in the proposal, in the confirmation |
| 35 | prompt, in the apply-loop output, in the regeneration output, in |
| 36 | the recap, in status-change comments posted to the issue itself, |
| 37 | anywhere — the reference must be one click away in whatever |
| 38 | surface it lands on: |
| 39 | |
| 40 | - **On markdown surfaces** (the proposal body and status-change |
| 41 | comments posted to `<tracker>`, the regenerated CVE JSON's |
| 42 | reference list, any draft email reply text destined for the |
| 43 | `<security-list>` Gmail thread): use the markdown link form |
| 44 | per the "Linking `<tracker>` issues and PRs" section of |
| 45 | [`AGENTS.md`](../../AGENTS.md): |
| 46 | - **Issue**: `[<tracker>#221](https://github.com/<tracker>/issues/221)` |
| 47 | (or `[#221](https://github.com/<tracker>/issues/221)` when |
| 48 | the repository is already obvious from context, e.g. inside |
| 49 | a status-change comment *on* that same issue). |
| 50 | - **PR**: `[<tracker>#NNN](https://github.com/<tracker>/pull/NNN)` |
| 51 | (`.../pull/N`, not `.../issues/N`). |
| 52 | - **Comment**: link to the `#issuecomment-<C>` anchor, e.g. |
| 53 | `[<tracker>#216 — issuecomment-4252393493](https://github.com/<tracker>/issues/216#issuecomment-4252393493)`. |
| 54 | - **Milestone**: link to `https://github.com/<tracker>/milestone/<number>` |
| 55 | (not the title), because milestone titles can change and the |
| 56 | number is stable. Example: `[3.2.2](https://github.com/<tracker>/milestone/42)`. |
| 57 | |
| 58 | - **On terminal surfaces** (the apply-loop progress messages, |
| 59 | the confirmation prompt, the recap printed to the user's |
| 60 | terminal at the end): wrap the visible short form |
| 61 | (`<tracker>#NNN`) in **OSC 8 hyperlink escape sequences** |
| 62 | (`\e]8;;<URL>\e\\<tracker>#NNN\e]8;;\e\\`) so modern terminals |
| 63 | (iTerm2, Kitty, GNOME Terminal, WezTerm, Windows Terminal, …) |
| 64 | render the short text as clickable. Where OSC 8 is unsupported |
| 65 | (CI logs, dumb terminals), fall back to printing the bare URL |
| 66 | on the same line after the number. |
| 67 | |
| 68 | Bare `#NNN` / `<tracker>#NNN` with no link wrapper of any kind |
| 69 | is never acceptable — not in terminal output, not in posted |
| 70 | c |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
