deal-with-security-advisory skill | PlugMCP

deal-with-security-advisory

paperclipai112kstars

Autonomous AgentsProductivityProject Management

1---2name: deal-with-security-advisory3description: >4---56# .agents/skills/deal-with-security-advisory/SKILL.md

SKILL.mdAgent skill

Transport: File
Status: Listed

SKILL.md

Install

The skill file stays in the publisher's repository.

Paste the copied command in a terminal. It installs this SKILL.md into that agent.

shterminal

1npx skills add paperclipai/paperclip --skill deal-with-security-advisory -a cursor -y

Paste the copied command in a terminal. It installs this SKILL.md into that agent.

shterminal

1npx skills add paperclipai/paperclip --skill deal-with-security-advisory -a claude-code -y

Paste the copied command in a terminal. It installs this SKILL.md into that agent.

shterminal

1npx skills add paperclipai/paperclip --skill deal-with-security-advisory -a codex -y

Paste the copied command in a terminal. It installs this SKILL.md into that agent.

shterminal

1npx skills add paperclipai/paperclip --skill deal-with-security-advisory -a grok -y

Send the copied message in a Grok Bot chat. The Bot fetches this SKILL.md from GitHub and adds it to the skills all your Bots share.

txtGrok Bot chat

1Install this skill: https://github.com/paperclipai/paperclip/tree/HEAD/.agents/skills/deal-with-security-advisory

Download skill .agents/skills/deal-with-security-advisory/SKILL.md on GitHub

.agents/skills/deal-with-security-advisory/SKILL.mdMarkdown · UTF-8

Skill facts

Agent skill

File: .agents/skills/deal-with-security-advisory/SKILL.md
Publisher: paperclipai
Hosting

FAQ

Questions

From the publisher

SKILL.md

name: deal-with-security-advisory
description: Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security releases.

Security Vulnerability Response Instructions

⚠️ CRITICAL: This is a security vulnerability. Everything about this process is confidential until the advisory is published. Do not mention the vulnerability details in any public commit message, PR title, branch name, or comment. Do not push anything to a public branch. Do not discuss specifics in any public channel. Assume anything on the public repo is visible to attackers who will exploit the window between disclosure and user upgrades.

Context

A security vulnerability has been reported via GitHub Security Advisory:

Advisory: {{ghsaId}} (e.g. GHSA-x8hx-rhr2-9rf7)
Reporter: {{reporterHandle}}
Severity: {{severity}}
Notes: {{notes}}

Step 0: Fetch the Advisory Details

Pull the full advisory so you understand the vulnerability before doing anything else:

gh api repos/paperclipai/paperclip/security-advisories/{{ghsaId}}

Read the description, severity, cvss, and vulnerabilities fields. Understand the attack vector before writing code.

Step 1: Acknowledge the Report

⚠️ This step requires a human. The advisory thread does not have a comment API. Ask the human operator to post a comment on the private advisory thread acknowledging the report. Provide them this template:

Thanks for the report, @{{reporterHandle}}. We've confirmed the issue and are working on a fix. We're targeting a patch release within {{timeframe}}. We'll keep you updated here.

Give your human this template, but still continue

Below we use gh tools - you do have access and credentials outside of your sandbox, so use them.

Step 2: Create the Temporary Private Fork

This is where all fix development happens. Never push to the public repo.

gh api --method POST \
  repos/paperclipai/paperclip/security-advisories/{{ghsaId}}/forks

# Clone the private fork somewhere outside ~/paperclip
git clone <clone_url_from_response> ~/security-patch-{{ghsaId}}
cd ~/security-patch-{{ghsaId}}
git checkout -b security-fix

git add -A
git commit -m "Fix security vulnerability"
git push origin security-fix

gh api --method POST \
  repos/paperclipai/paperclip/security-advisories/{{ghsaId}}/cve

gh api repos/paperclipai/paperclip/security-advisories/{{ghsaId}} --jq '.credits'

gh api --method PATCH \
  repos/paperclipai/paperclip/security-advisories/{{ghsaId}} \
  --input - << 'EOF'
{
  "credits": [
    {
      "login": "{{reporterHandle}}",
      "type": "reporter"
    }
  ]
}
EOF

gh api --method PATCH \
  repos/paperclipai/paperclip/security-advisories/{{ghsaId}} \
  --input - << 'EOF'
{
  "state": "published",
  "vulnerabilities": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "paperclip"
      },
      "vulnerable_version_range": "< {{patchedVersion}}",
      "patched_versions": "{{patchedVersion}}"
    }
  ]
}
EOF

cd ~/paperclip
git pull origin master

gh release create v{{patchedVersion}} \
  --repo paperclipai/paperclip \
  --title "v{{patchedVersion}} — Security Release" \
  --notes "## Security Release

This release fixes a critical security vulnerability.

### What was fixed
{{briefDescription}} (e.g., Remote code execution via DNS rebinding in \`local_trusted\` mode)

### Advisory
https://github.com/paperclipai/paperclip/security/advisories/{{ghsaId}}

### Credit
Thanks to @{{reporterHandle}} for responsibly disclosing this vulnerability.

### Action required
All users running versions prior to {{patchedVersion}} should upgrade immediately."

# Verify the advisory is published and CVE is assigned
gh api repos/paperclipai/paperclip/security-advisories/{{ghsaId}} \
  --jq '{state: .state, cve_id: .cve_id, published_at: .published_at}'

# Verify the release exists
gh release view v{{patchedVersion}} --repo paperclipai/paperclip

deal-with-security-advisory

Install

Skill facts

Questions

How do I install deal-with-security-advisory?

Where does deal-with-security-advisory live?

Which agents can use deal-with-security-advisory?

SKILL.md

Security Vulnerability Response Instructions

Context

Step 0: Fetch the Advisory Details

Step 1: Acknowledge the Report

Step 2: Create the Temporary Private Fork

Step 3: Develop and Validate the Fix

Step 4: Coordinate with the Reporter

Step 5: Request a CVE

Step 6: Publish Everything Simultaneously

6a. Verify reporter credit before publishing

6b. Update the advisory with the patched version and publish

6c. Cut a release immediately after merge

Step 7: Post-Publication Verification