mirror of
https://github.com/FOSSBilling/FOSSBilling.git
synced 2026-10-23 03:37:01 +09:00
Adam Daley
1420584f6d
* Add security-advisory-triage skill Codifies the two-stage workflow for handling a reported GitHub Security Advisory: verify it against current code with file:line evidence, then refine its title/description/CVSS/CWE metadata to match this repo's actual publish conventions before applying it. Includes a living house-style reference derived from this repo's own published advisories. Lives at .agents/skills/ with .claude/skills symlinked to it, matching the existing AGENTS.md/.claude/CLAUDE.md convention for cross-tool agent support. * Fix spellcheck: add GHSA/macrovector/rubygems, ignore skills reference dir The skills reference file legitimately contains GHSA advisory IDs as provenance examples; those are opaque identifiers, not real words, and new ones will keep appearing as more advisories get referenced there over time, so excluding the directory from spellcheck avoids repeated dictionary churn rather than fixing it once. * Address CodeRabbit review on security-advisory-triage skill - Stage 1's current-code check now requires an exact revision match (fetch + clean worktree + exact rev-parse comparison) instead of only an ancestor check, which could pass against a stale or divergent base. - Stage 1's related-history step now queries each advisory state explicitly with --method GET, and calls out that gh api silently sends a POST (hitting the advisory-creation endpoint) when -f is used without --method GET. Verified directly against this repo: an unfiltered call does return every state for a maintainer-authenticated token, but explicit per-state queries are more portable. - Confidentiality note broadened to cover chat/review/tool output, not just committed artifacts. - CVSS guidance now distinguishes the nested read path (cvss_severities.cvss_v3/cvss_v4) from the flat write field (cvss_vector_string), and notes severity/cvss_vector_string are mutually exclusive on write. - The live-advisory PATCH checklist now lists the actual top-level fields (summary, description, cwe_ids, cvss_vector_string/severity) instead of vaguely saying 'the description body', notes vulnerabilities is an array rather than assuming index [0] is everything, and says to PATCH the complete object per entry rather than a partial one. - Added language tags to two fenced code blocks (shell, markdown) per markdownlint MD040. * Fix data-loss gap in vulnerabilities PATCH guidance The 'send the complete object' instruction added last round listed only four fields (package.ecosystem/name, vulnerable_version_range, patched_versions) and omitted vulnerable_functions, which is a real field on the object (confirmed: this session's own successful PATCH sent it as an empty array). Following that guidance literally on an advisory where vulnerable_functions is actually populated would erase it. Added the missing field.
Symbolic link
1 line
17 B
Plaintext
Symbolic link
1 line
17 B
Plaintext
../.agents/skills |