github-manage-security-alerts-skill 1.0.1 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CONTRIBUTING.md +2 -2
- package/README.md +17 -20
- package/package.json +11 -2
package/CONTRIBUTING.md
CHANGED
|
@@ -22,8 +22,8 @@ python -m venv .venv
|
|
|
22
22
|
From repo root, run:
|
|
23
23
|
|
|
24
24
|
```powershell
|
|
25
|
-
python -m compileall "
|
|
26
|
-
python "
|
|
25
|
+
python -m compileall "scripts"
|
|
26
|
+
python "scripts/manage_github_security_alerts.py" --help
|
|
27
27
|
```
|
|
28
28
|
|
|
29
29
|
If you touched command behavior, include example command invocations and expected output snippets in your PR description.
|
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
[](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/releases) [](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/stargazers) [](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/forks) [](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/issues) [](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/pulls?q=sort%3Aupdated-desc+is%3Apr+is%3Aopen) [](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/blob/main/LICENSE) [](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/network/updates)
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
An open-agent skill for inspecting and managing GitHub repository security alerts across:
|
|
6
6
|
|
|
7
7
|
- code scanning
|
|
8
8
|
- Dependabot
|
|
@@ -60,39 +60,36 @@ CHANGELOG.md
|
|
|
60
60
|
|
|
61
61
|
---
|
|
62
62
|
|
|
63
|
-
##
|
|
63
|
+
## Agent compatibility
|
|
64
64
|
|
|
65
|
-
|
|
65
|
+
This is a root `SKILL.md` package. `npx skills` can install it directly from GitHub, and `npx skills experimental_sync` can discover it from `node_modules` because the npm package ships `SKILL.md` at the package root.
|
|
66
66
|
|
|
67
|
-
|
|
67
|
+
Use `--agent universal` for agents that consume the shared `.agents/skills` layout. Use `--agent "*"` only when you intentionally want to install to every supported agent directory.
|
|
68
68
|
|
|
69
69
|
```powershell
|
|
70
|
-
|
|
71
|
-
|
|
70
|
+
npx skills add Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill -g --agent universal -y
|
|
71
|
+
npx skills add Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill -g --agent "*" -y
|
|
72
|
+
npm install --save-dev github-manage-security-alerts-skill
|
|
73
|
+
npx skills experimental_sync --agent universal -y
|
|
72
74
|
```
|
|
73
75
|
|
|
74
|
-
|
|
76
|
+
OpenAI-specific display metadata lives in `agents/openai.yaml`. The portable skill contract is `SKILL.md` plus the referenced `assets/` and `scripts/` files.
|
|
75
77
|
|
|
76
|
-
|
|
77
|
-
- Repository: `Github-Security-CodeScanning-Alerts-Skill`
|
|
78
|
-
- Workflow filename: `release-skill.yml`
|
|
79
|
-
- Allowed action: `npm stage publish`
|
|
80
|
-
|
|
81
|
-
CLI equivalent:
|
|
78
|
+
---
|
|
82
79
|
|
|
83
|
-
|
|
84
|
-
npm trust github "github-manage-security-alerts-skill" --repo "Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill" --file "release-skill.yml" --allow-stage-publish
|
|
85
|
-
```
|
|
80
|
+
## Publishing
|
|
86
81
|
|
|
87
|
-
|
|
82
|
+
The skill is packaged for GitHub releases and npm as `github-manage-security-alerts-skill`.
|
|
88
83
|
|
|
89
|
-
|
|
84
|
+
Verify the package locally before publishing:
|
|
90
85
|
|
|
91
86
|
```powershell
|
|
92
|
-
npm
|
|
93
|
-
npm
|
|
87
|
+
npm run release:verify
|
|
88
|
+
npm publish --access public --provenance
|
|
94
89
|
```
|
|
95
90
|
|
|
91
|
+
GitHub Actions publishes with npm OIDC trusted publishing using `npm publish --access public --provenance`. Configure the npm package trusted publisher for repository `Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill` and workflow `.github/workflows/release-skill.yml`. The workflow intentionally does not use `npm stage` commands.
|
|
92
|
+
|
|
96
93
|
---
|
|
97
94
|
|
|
98
95
|
## Quick start
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "github-manage-security-alerts-skill",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.2",
|
|
4
4
|
"private": false,
|
|
5
5
|
"description": "Codex skill for inspecting and triaging GitHub security alerts.",
|
|
6
6
|
"license": "Unlicense",
|
|
@@ -15,12 +15,21 @@
|
|
|
15
15
|
"homepage": "https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill#readme",
|
|
16
16
|
"keywords": [
|
|
17
17
|
"agent-skill",
|
|
18
|
+
"agent-skills",
|
|
19
|
+
"ai-agent",
|
|
20
|
+
"claude-code",
|
|
18
21
|
"code-scanning",
|
|
19
22
|
"codex",
|
|
23
|
+
"cursor",
|
|
20
24
|
"dependabot",
|
|
25
|
+
"gemini-cli",
|
|
21
26
|
"github-security",
|
|
27
|
+
"github-copilot",
|
|
22
28
|
"openai",
|
|
23
|
-
"
|
|
29
|
+
"opencode",
|
|
30
|
+
"secret-scanning",
|
|
31
|
+
"universal",
|
|
32
|
+
"zed"
|
|
24
33
|
],
|
|
25
34
|
"files": [
|
|
26
35
|
"SKILL.md",
|