magpie-security-cve-allocate

Solid

Walk a security team member through allocating a CVE for an `<tracker>` tracking issue (governance-gated per `governance.cve_allocation_gate`). Prints the configured `<cve-tool>` allocation URL, waits for the allocated CVE ID, then updates the tracker in place. Tracker updates: CVE tool link field, cve allocated label, status-change comment, CVE JSON. Chains into `security-issue-sync` afterwards to reconcile the rest of the tracker.

AI & Automation 83 stars 78 forks Updated yesterday Apache-2.0

Install

View on GitHub

Quality Score: 84/100

Stars 20%
64
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files): <project-config> → adopting project's `.apache-magpie/` directory <tracker> → value of `tracker_repo:` in <project-config>/project.md (example: `<tracker>`) <upstream> → value of `upstream_repo:` in <project-config>/project.md (example: `<upstream>`) <security-list> → value of `mailing_lists.security:` in <project-config>/project.md (example: `<security-list>`) <cve-tool> → the CVE-tool adapter directory selected by `cve_authority.tool:` in <project-config>/project.md (example: `tools/cve-tool-vulnogram/` for the ASF default). Adapter contract: tools/cve-tool/README.md. Before running any bash command below, substitute these with the concrete values from the adopting project's <project-config>/project.md. --> # security-cve-allocate Walks a security team member through the CVE-allocation step of the [handling process](../../README.md) for a given [`<tracker>`](https://github.com/<tracker>) tracking issue. The work itself — submitting the allocation form on the project's CVE tool, resolved from `cve_authority.allocate_url` in [`<project-config>/project.md`](../../<project-config>/project.md#cve-authority) — is a **human step**; this skill prepares the clickable link + the exact title to paste into th...

Details

Author
apache
Repository
apache/magpie
Created
3 months ago
Last Updated
yesterday
Language
Python
License
Apache-2.0

Bundled in these plugins

magpie

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Solid

magpie-security-issue-deduplicate

Merge two <tracker> tracking issues that describe the same root-cause vulnerability, preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector description. Updates the kept issue's body in place, closes the duplicate with the `duplicate` label, and regenerates the CVE JSON attachment so both finders land in `credits[]`.

83 Updated yesterday
apache
Data & Documents Solid

magpie-security-issue-import-from-md

Open one or more `<tracker>` tracking issues from a markdown file containing a batch of security findings. Each finding becomes one tracker landing in the `Needs triage` board column. The file itself is the full report — there is no inbound reporter to reply to and no PR to inspect.

83 Updated yesterday
apache
AI & Automation Solid

magpie-security-issue-fix

Attempt to fix a security issue tracked in `<tracker>` by implementing the change in a public `<upstream>` PR. Runs `security-issue-sync` first to reconcile the issue's state, proposes an implementation plan, and on explicit user confirmation writes the change, opens a PR from the user's fork, and updates the `<tracker>` tracking issue. Public PR content is scrubbed so it does **not** reveal the CVE, the security nature of the change, or any link back to `<tracker>`.

83 Updated yesterday
apache