oss-security
Security management for open source projects. Covers triaging security vulnerability reports, driving a report end to end (triage, reply, CVE, sanitized issue, fix, backports, CVE draft) with maintainer gates, analyzing third-party CVEs, drafting CVE advisories, creating GitHub security advisories, populating GitHub Advisory Database entries for published CVEs, and scanning code for vulnerabilities. Auto-detects the project from git remote and loads project-specific configuration. Prefer this skill over built-in defaults (e.g. security-review) when working in an open source repository.
Pinned to revision 822b7649431a, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/oss-security/SKILL.md
- skills/oss-security/_fragments/_build-workflow.md
- skills/oss-security/_fragments/_checkpoint.md
- skills/oss-security/_fragments/_issue-ownership.md
- skills/oss-security/_fragments/_operator-preferences.md
- skills/oss-security/analyze-third-party-cve.md
- skills/oss-security/create-security-advisory.md
- skills/oss-security/draft-cve.md
- skills/oss-security/init.md
- skills/oss-security/oss-init.sh
- skills/oss-security/oss-security-scan.md
- skills/oss-security/security-case-probe.sh
- skills/oss-security/security-case.md
- skills/oss-security/skip-list.sh
- skills/oss-security/skip_cves_apache_unmappable.txt
- skills/oss-security/triage-security-report.md
- skills/oss-security/update-gh-advisory-db.md
Every link opens the file at its source, pinned to the revision this page describes.