security-tracker-stats-dashboard
starsforks
How to install security-tracker-stats-dashboard?
apache/magpie/security-tracker-stats-dashboard
$npx -y skills add apache/magpie --skill security-tracker-stats-dashboardGenerate a self-contained HTML dashboard of <tracker> repository statistics for security-team review.
SKILL.md
| 1 | <!-- SPDX-License-Identifier: Apache-2.0 |
| 2 | https://www.apache.org/licenses/LICENSE-2.0 --> |
| 3 | |
| 4 | <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files): |
| 5 | <project-config> -> adopting project's `.apache-magpie/` directory |
| 6 | <framework> -> framework root (the `.apache-magpie/` |
| 7 | snapshot in an adopter repo, or `.` in the |
| 8 | framework standalone checkout) |
| 9 | <tracker> -> value of `tracker_repo:` in <project-config>/project.md |
| 10 | (example: <tracker>) |
| 11 | <upstream> -> value of `upstream_repo:` in <project-config>/project.md |
| 12 | (example: <upstream>); may be null for |
| 13 | trackers whose fixes do not land in a |
| 14 | single upstream codebase. |
| 15 | Before running any bash command below, substitute these with the |
| 16 | concrete values from the adopting project's <project-config>/project.md. --> |
| 17 | |
| 18 | # security-tracker-stats-dashboard |
| 19 | |
| 20 | Read-only skill that renders a self-contained HTML page summarising |
| 21 | the state of `<tracker>` over time. The skill wraps the |
| 22 | [`tools/security-tracker-stats-dashboard/`](../../tools/security-tracker-stats-dashboard/README.md) |
| 23 | runtime tool — both the slash-command path (this skill) and the |
| 24 | script path (`run.sh`) run the same fetch + render pipeline; the |
| 25 | skill adds invocation niceties (resolving cache paths, surfacing the |
| 26 | output URL, proposing a stale-cache refresh) but never mutates |
| 27 | anything. |
| 28 | |
| 29 | The skill is **read-only on GitHub** — it does not create or modify |
| 30 | issues, comments, labels, or PRs. It only fetches data via `gh` and |
| 31 | renders an HTML file. |
| 32 | |
| 33 | --- |
| 34 | |
| 35 | ## Adopter overrides |
| 36 | |
| 37 | Before running the default behaviour documented |
| 38 | below, this skill consults |
| 39 | [`.apache-magpie-local/security-tracker-stats-dashboard.md`](../../docs/setup/agentic-overrides.md) (personal, gitignored) and [`.apache-magpie-overrides/security-tracker-stats-dashboard.md`](../../docs/setup/agentic-overrides.md) (committed, project-wide) |
| 40 | in the adopter repo if it exists, and applies any |
| 41 | agent-readable overrides it finds. See |
| 42 | [`docs/setup/agentic-overrides.md`](../../docs/setup/agentic-overrides.md) |
| 43 | for the contract — what overrides may contain, hard |
| 44 | rules, the reconciliation flow on framework upgrade, |
| 45 | upstreaming guidance. |
| 46 | |
| 47 | Configuration for the *renderer* (bucket granularity, milestones, |
| 48 | categories, scope labels, triage keywords, …) lives in a separate |
| 49 | YAML file the adopter places at |
| 50 | `.apache-magpie-overrides/security-tracker-stats.yaml` (path is |
| 51 | adopter-configurable via `tracker_stats_config:` in |
| 52 | [`<project-config>/security-tracker-stats.md`](../../projects/_template/security-tracker-stats.md)). |
| 53 | The agentic override file above is reserved for *behavioural* |
| 54 | overrides of this skill (when to propose a refresh, where to write |
| 55 | the HTML, etc.); renderer knobs go in the YAML config. |
| 56 | |
| 57 | **Hard rule**: agents NEVER modify the snapshot under |
| 58 | `<adopter-repo>/.apache-magpie/`. Local modifications |
| 59 | go in the override file. Framework changes go via PR |
| 60 | to `apache/magpie`. |
| 61 | |
| 62 | --- |
| 63 | |
| 64 | ## Snapshot drift |
| 65 | |
| 66 | Also at the top of every run, this skill compares the |
| 67 | gitignored `.apache-magpie.local.lock` (per-machine |
| 68 | fetch) against the committed `.apache-magpie.lock` |
| 69 | (the project pin). On mismatch the skill surfaces the |
| 70 | gap and proposes |
| 71 | [`/magpie-setup upgrade`](../setup/upgrade.md). |
| 72 | The proposal is non-blocking — the user may defer if |
| 73 | they want to run with the local snapshot for now. See |
| 74 | [`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) |
| 75 | for the full flow. |
| 76 | |
| 77 | Drift severity: |
| 78 | |
| 79 | - **method or URL differ** -> ✗ full re-install needed. |
| 80 | - **ref differs** (project bumped tag, or `git-branch` |
| 81 | local is behind upstream tip) -> ⚠ sync needed. |
| 82 | - **`svn-zip` SHA-512 mismatches the committed |
| 83 | anchor** -> ✗ security-flagged; investigate before |
| 84 | upgrading. |
| 85 | |
| 86 | --- |
| 87 | |
| 88 | ## Prerequisites |
| 89 | |
| 90 | - `gh` authenticated with read access to `<tracker>` (and to |
| 91 | `<upstream>` for PR metadata, when configured). |
| 92 | - `python3` (3.9+). |
| 93 | - `jq` (used by `fetch_events.py` via gh's `--jq` flag). |
| 94 | - Network access to `api.github.com` and (for *viewing* the output |
| 95 | HTML) Plotly's CDN. |
| 96 | - Optional: PyYAML. When missing, the renderer falls back to a |
| 97 | bundled minima |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
