github-manage-security-alerts-skill 1.0.1 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CONTRIBUTING.md +9 -9
  2. package/README.md +22 -25
  3. package/SKILL.md +11 -10
  4. package/agents/openai.yaml +6 -6
  5. package/package.json +83 -48
package/CONTRIBUTING.md CHANGED
@@ -1,10 +1,10 @@
1
- ## Contributing to GitHub Security Alerts Skill
1
+ # Contributing to GitHub Security Alerts Skill
2
2
 
3
3
  Thanks for contributing.
4
4
 
5
5
  This repository is primarily a skill + helper tooling repo, so high-signal docs and safe defaults matter as much as code changes.
6
6
 
7
- ### Development setup
7
+ ## Development setup
8
8
 
9
9
  1. Clone the repository.
10
10
  2. Ensure Python 3.10+ is available.
@@ -17,31 +17,31 @@ python -m venv .venv
17
17
  .\.venv\Scripts\Activate.ps1
18
18
  ```
19
19
 
20
- ### Local sanity checks
20
+ ## Local sanity checks
21
21
 
22
22
  From repo root, run:
23
23
 
24
24
  ```powershell
25
- python -m compileall ".github/skills/github-manage-security-alerts/scripts"
26
- python ".github/skills/github-manage-security-alerts/scripts/manage_github_security_alerts.py" --help
25
+ python -m compileall "scripts"
26
+ python "scripts/manage_github_security_alerts.py" --help
27
27
  ```
28
28
 
29
29
  If you touched command behavior, include example command invocations and expected output snippets in your PR description.
30
30
 
31
- ### Security requirements
31
+ ## Security requirements
32
32
 
33
33
  - **Do not** commit secrets.
34
34
  - **Do not** pass GitHub tokens as CLI literals.
35
35
  - Use environment variables (`GITHUB_TOKEN`, `GH_TOKEN`, or `--token-env`).
36
36
  - Prefer `--dry-run` for mutation commands in docs/examples.
37
37
 
38
- ### Commit messages
38
+ ## Commit messages
39
39
 
40
40
  This repo includes commit message conventions in:
41
41
 
42
- - `.github/copilot-commit-message-instructions.md`
42
+ - `.github/agent-commit-message-instructions.md`
43
43
 
44
- ### Pull request checklist
44
+ ## Pull request checklist
45
45
 
46
46
  - [ ] Documentation updated (README/SKILL/help text as needed)
47
47
  - [ ] Commands in docs are still valid
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [![latest GitHub release.](https://flat.badgen.net/github/release/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill?color=cyan)](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/releases) [![GitHub stars.](https://flat.badgen.net/github/stars/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill?color=yellow)](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/stargazers) [![GitHub forks.](https://flat.badgen.net/github/forks/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill?color=green)](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/forks) [![GitHub open issues.](https://flat.badgen.net/github/open-issues/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill?color=red)](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/issues) [![GitHub PRs.](https://flat.badgen.net/github/open-prs/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill?color=orange)](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/pulls?q=sort%3Aupdated-desc+is%3Apr+is%3Aopen) [![GitHub license](https://flat.badgen.net/github/license/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill?color=purple)](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/blob/main/LICENSE) [![GitHub Dependabot](https://flat.badgen.net/github/dependabot/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill?color=blue)](https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/network/updates)
4
4
 
5
- A Copilot / AI skill for inspecting and managing GitHub repository security alerts across:
5
+ An open-agent skill for inspecting and managing GitHub repository security alerts across:
6
6
 
7
7
  - code scanning
8
8
  - Dependabot
@@ -60,39 +60,36 @@ CHANGELOG.md
60
60
 
61
61
  ---
62
62
 
63
- ## Publishing
63
+ ## Agent compatibility
64
64
 
65
- The skill is packaged for GitHub releases and npm as `github-manage-security-alerts-skill`.
65
+ This is a root `SKILL.md` package. `npx skills` can install it directly from GitHub, and `npx skills experimental_sync` can discover it from `node_modules` because the npm package ships `SKILL.md` at the package root.
66
66
 
67
- For the first npm publish, publish locally once so the package exists:
67
+ Use `--agent universal` for agents that consume the shared `.agents/skills` layout. Use `--agent "*"` only when you intentionally want to install to every supported agent directory.
68
68
 
69
69
  ```powershell
70
- npm run release:verify
71
- npm publish
70
+ npx skills add Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill -g --agent universal -y
71
+ npx skills add Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill -g --agent "*" -y
72
+ npm install --save-dev github-manage-security-alerts-skill
73
+ npx skills experimental_sync --agent universal -y
72
74
  ```
73
75
 
74
- Then configure npm trusted publishing for staged publishing:
76
+ OpenAI-specific display metadata lives in `agents/openai.yaml`. The portable skill contract is `SKILL.md` plus the referenced `assets/` and `scripts/` files.
75
77
 
76
- - Organization or user: `Nick2bad4u`
77
- - Repository: `Github-Security-CodeScanning-Alerts-Skill`
78
- - Workflow filename: `release-skill.yml`
79
- - Allowed action: `npm stage publish`
80
-
81
- CLI equivalent:
78
+ ---
82
79
 
83
- ```powershell
84
- npm trust github "github-manage-security-alerts-skill" --repo "Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill" --file "release-skill.yml" --allow-stage-publish
85
- ```
80
+ ## Publishing
86
81
 
87
- After that, create releases from GitHub Actions by pushing a `vX.Y.Z` tag or running the `Release Skill Bundle` workflow manually with an explicit version. The workflow uses npm OIDC trusted publishing to stage the package and does not require an npm automation token.
82
+ The skill is packaged for GitHub releases and npm as `github-manage-security-alerts-skill`.
88
83
 
89
- Approve the staged package after reviewing it:
84
+ Verify the package locally before publishing:
90
85
 
91
86
  ```powershell
92
- npm stage list "github-manage-security-alerts-skill"
93
- npm stage approve "<stage-id>"
87
+ npm run release:verify
88
+ npm publish --access public --provenance
94
89
  ```
95
90
 
91
+ GitHub Actions publishes with npm OIDC trusted publishing using `npm publish --access public --provenance`. Configure the npm package trusted publisher for repository `Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill` and workflow `.github/workflows/release-skill.yml`. The workflow intentionally does not use `npm stage` commands.
92
+
96
93
  ---
97
94
 
98
95
  ## Quick start
@@ -185,11 +182,11 @@ This repository includes a release workflow that creates a downloadable zip bund
185
182
 
186
183
  - Workflow: `.github/workflows/release-skill.yml`
187
184
  - Trigger:
188
- - push a tag like `v0.1.0`
189
- - run manually via **workflow_dispatch** with:
190
- - `release_type`: `patch` / `minor` / `major`
191
- - `version`: optional explicit `x.y.z` (overrides `release_type`)
192
- - `ref`: branch to release from (default `main`)
185
+ - push a tag like `v0.1.0`
186
+ - run manually via **workflow_dispatch** with:
187
+ - `release_type`: `patch` / `minor` / `major`
188
+ - `version`: optional explicit `x.y.z` (overrides `release_type`)
189
+ - `ref`: branch to release from (default `main`)
193
190
  - Asset: `github-security-codescanning-alerts-skill-<tag>.zip`
194
191
 
195
192
  Examples:
package/SKILL.md CHANGED
@@ -1,9 +1,8 @@
1
1
  ---
2
- name: "github-manage-security-alerts"
3
- description: "Use when a user asks to inspect, triage, bulk-fix, bulk-dismiss, dismiss, reopen, resolve, assign, summarize, export, or configure GitHub repository security alerts across repositories, including code scanning, Dependabot, Dependabot malware, and secret scanning; securely reads the GitHub token from environment variables such as GITHUB_TOKEN"
2
+ name: github-manage-security-alerts
3
+ description: Use when the user asks to inspect, triage, summarize, export, or safely update GitHub security alerts for code scanning, Dependabot, malware, or secret scanning.
4
4
  license: "Unlicense"
5
- metadata:
6
- short-description: "Inspect and triage GitHub security alerts"
5
+ metadata: { "short-description": "Inspect and triage GitHub security alerts" }
7
6
  ---
8
7
 
9
8
  # GitHub Security Alerts Management
@@ -29,7 +28,7 @@ The bundled helper is repository-agnostic:
29
28
  - let it auto-detect `owner/repo` and the GitHub host from the git remote
30
29
  - or pass `--repository owner/repo` explicitly
31
30
  - authenticate via environment variable instead of putting a token on the command line
32
- - optionally override the API base URL for custom environments
31
+ - optionally override the API or web base URL for custom environments
33
32
 
34
33
  ## Compatibility
35
34
 
@@ -40,12 +39,13 @@ Supports GitHub.com and standard GHES API base URL derivation from git remotes,
40
39
  ## Invocation hints
41
40
 
42
41
  Use `repo` when the target is a local checkout, defaulting to `.`.
43
- Use optional `repository` and `token_env` values when auto-detection is not enough.
42
+ Use optional `repository`, `api_base_url`, `web_base_url`, and `token_env` values when auto-detection is not enough.
44
43
  Common commands include `summary`, `export-alerts`, `bulk-update-alerts`, `repo-security-overview`, `list-code-scanning`, `show-code-scanning`, `update-code-scanning`, `list-dependabot`, `show-dependabot`, `update-dependabot`, `list-malware`, `show-malware`, `update-malware`, `list-secret-scanning`, `show-secret-scanning`, `update-secret-scanning`, `list-secret-locations`, `secret-scan-history`, and `api-call`.
45
44
 
46
45
  ## Security model
47
46
 
48
47
  Do not paste GitHub tokens into command arguments.
48
+ Do not use `--show-secret-values` unless the user explicitly asks for unredacted secret values and confirms the exposure risk. Prefer redacted alert metadata, secret locations, validity, and resolution state. If unredacted output is required for remediation, do not paste secret material into chat, issue comments, PRs, commits, logs, or saved reports.
49
49
 
50
50
  Preferred pattern:
51
51
 
@@ -67,6 +67,7 @@ python "<path-to-skill>/scripts/manage_github_security_alerts.py" summary --repo
67
67
  - `repo`: path inside the target repository checkout (default `.`)
68
68
  - `repository`: optional explicit `owner/repo` override
69
69
  - `api_base_url`: optional explicit API base URL override
70
+ - `web_base_url`: optional explicit web base URL override for rendered links
70
71
  - `token_env`: optional environment variable name containing the token; repeatable for fallbacks
71
72
  - `json`: optional machine-readable output flag
72
73
 
@@ -74,13 +75,13 @@ python "<path-to-skill>/scripts/manage_github_security_alerts.py" summary --repo
74
75
 
75
76
  GitHub surfaces malware findings as **Dependabot malware alerts**.
76
77
 
77
- There is not a separate repository alert family with its own dedicated REST surface. The bundled helper therefore treats malware as a filtered subset of Dependabot alerts and cross-references each alert's advisory GHSA against the GitHub Advisory Database to identify advisories whose type is `malware`.
78
+ GitHub does not provide a separate repository alert family with its own dedicated REST surface. The bundled helper therefore treats malware as a filtered subset of Dependabot alerts and cross-references each alert's advisory GHSA against the GitHub Advisory Database to identify advisories whose type is `malware`.
78
79
 
79
80
  That means:
80
81
 
81
82
  - `list-malware`, `show-malware`, and `update-malware` are backed by Dependabot alert APIs
82
83
  - malware classification is strongest on GitHub.com, where the advisory database endpoint is available
83
- - if advisory type lookup is unavailable on the target host, the helper reports that clearly instead of silently guessing
84
+ - if advisory type lookup is unavailable on the target host, the helper reports that state instead of silently guessing
84
85
 
85
86
  ## Quick start
86
87
 
@@ -150,7 +151,7 @@ python "<path-to-skill>/scripts/manage_github_security_alerts.py" list-malware -
150
151
  python "<path-to-skill>/scripts/manage_github_security_alerts.py" list-secret-scanning --repo "." --state open
151
152
  ```
152
153
 
153
- Secret values are hidden by default.
154
+ Secret values are hidden by default. Keep that default unless the user explicitly confirms that unredacted secret output is necessary.
154
155
 
155
156
  ### 9. Resolve or reopen a secret scanning alert
156
157
 
@@ -190,7 +191,7 @@ python "<path-to-skill>/scripts/manage_github_security_alerts.py" api-call --rep
190
191
  - Fix real defects in code or dependency configuration when appropriate.
191
192
  - Dismiss only when you have a clear justification.
192
193
  - Reopen alerts when the earlier dismissal or resolution is no longer valid.
193
- - Use `bulk-update-alerts` when a repository has dozens or hundreds of obviously mis-triaged alerts that need the same action.
194
+ - Use `bulk-update-alerts` when a repository has dozens or hundreds of already-reviewed, mis-triaged alerts that need the same action.
194
195
  5. Apply mutations carefully.
195
196
  - Prefer `--dry-run` first for risky changes.
196
197
  - Add a short, actionable dismissal or resolution comment.
package/agents/openai.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  interface:
2
- display_name: "GitHub Manage Security Alerts"
3
- short_description: "Inspect and triage GitHub security alerts"
4
- icon_small: "./assets/github-manage-security-alerts-small.svg"
5
- icon_large: "./assets/github-manage-security-alerts.png"
6
- brand_color: "#24292F"
7
- default_prompt: "Use $github-manage-security-alerts to inspect GitHub security alerts, summarize exposure, and apply safe triage actions."
2
+ display_name: "GitHub Manage Security Alerts"
3
+ short_description: "Inspect and triage GitHub security alerts"
4
+ icon_small: "./assets/github-manage-security-alerts-small.svg"
5
+ icon_large: "./assets/github-manage-security-alerts.png"
6
+ brand_color: "#24292F"
7
+ default_prompt: "Use $github-manage-security-alerts to inspect GitHub security alerts, summarize exposure, and apply safe triage actions."
package/package.json CHANGED
@@ -1,50 +1,85 @@
1
1
  {
2
- "name": "github-manage-security-alerts-skill",
3
- "version": "1.0.1",
4
- "private": false,
5
- "description": "Codex skill for inspecting and triaging GitHub security alerts.",
6
- "license": "Unlicense",
7
- "type": "module",
8
- "repository": {
9
- "type": "git",
10
- "url": "git+https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill.git"
11
- },
12
- "bugs": {
13
- "url": "https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/issues"
14
- },
15
- "homepage": "https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill#readme",
16
- "keywords": [
17
- "agent-skill",
18
- "code-scanning",
19
- "codex",
20
- "dependabot",
21
- "github-security",
22
- "openai",
23
- "secret-scanning"
24
- ],
25
- "files": [
26
- "SKILL.md",
27
- "LICENSE.txt",
28
- "agents/",
29
- "assets/",
30
- "scripts/",
31
- "CHANGELOG.md",
32
- "CONTRIBUTING.md",
33
- "README.md",
34
- "SECURITY.md"
35
- ],
36
- "engines": {
37
- "node": ">=22.14"
38
- },
39
- "scripts": {
40
- "validate": "node tools/validate-skill-package.mjs",
41
- "pack:dry-run": "npm pack --dry-run",
42
- "publish:local": "npm run release:verify && npm publish --access public",
43
- "release:verify": "npm run validate && npm run pack:dry-run"
44
- },
45
- "codexSkill": {
46
- "name": "github-manage-security-alerts",
47
- "path": ".",
48
- "githubReleaseAssetPrefix": "github-security-codescanning-alerts-skill"
49
- }
2
+ "name": "github-manage-security-alerts-skill",
3
+ "version": "1.0.3",
4
+ "private": false,
5
+ "description": "Codex skill for inspecting and triaging GitHub security alerts.",
6
+ "keywords": [
7
+ "agent-skill",
8
+ "agent-skills",
9
+ "ai-agent",
10
+ "claude-code",
11
+ "code-scanning",
12
+ "codex",
13
+ "cursor",
14
+ "dependabot",
15
+ "gemini-cli",
16
+ "github-copilot",
17
+ "github-security",
18
+ "openai",
19
+ "openclaw",
20
+ "opencode",
21
+ "secret-scanning",
22
+ "universal",
23
+ "zed"
24
+ ],
25
+ "homepage": "https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill#readme",
26
+ "bugs": {
27
+ "url": "https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/issues"
28
+ },
29
+ "repository": {
30
+ "type": "git",
31
+ "url": "git+https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill.git"
32
+ },
33
+ "license": "Unlicense",
34
+ "author": "Nick2bad4u <20943337+Nick2bad4u@users.noreply.github.com> (https://github.com/Nick2bad4u)",
35
+ "contributors": [
36
+ {
37
+ "name": "Nick2bad4u",
38
+ "email": "20943337+Nick2bad4u@users.noreply.github.com",
39
+ "url": "https://github.com/Nick2bad4u"
40
+ }
41
+ ],
42
+ "type": "module",
43
+ "files": [
44
+ "SKILL.md",
45
+ "LICENSE.txt",
46
+ "agents/",
47
+ "assets/",
48
+ "scripts/",
49
+ "CHANGELOG.md",
50
+ "CONTRIBUTING.md",
51
+ "README.md",
52
+ "SECURITY.md"
53
+ ],
54
+ "scripts": {
55
+ "lint:package-json": "npmPkgJsonLint . --config .npmpackagejsonlintrc.json",
56
+ "lint:remark": "remark . --frail --ignore-path .remarkignore",
57
+ "lint:remark:fix": "remark . --ignore-path .remarkignore --output",
58
+ "pack:dry-run": "npm pack --dry-run",
59
+ "publish:local": "npm run release:verify && npm publish --access public",
60
+ "release:verify": "npm run validate && npm run pack:dry-run",
61
+ "update-actions": "npx actions-up --yes --style sha",
62
+ "validate": "node tools/validate-skill-package.mjs"
63
+ },
64
+ "devDependencies": {
65
+ "npm-package-json-lint": "^10.4.1",
66
+ "npm-package-json-lint-config-nick2bad4u": "^1.0.3",
67
+ "prettier": "^3.9.0",
68
+ "prettier-config-nick2bad4u": "^1.0.18",
69
+ "remark": "^15.0.1",
70
+ "remark-cli": "^12.0.1",
71
+ "remark-config-nick2bad4u": "^1.1.2"
72
+ },
73
+ "engines": {
74
+ "node": ">=22.14"
75
+ },
76
+ "publishConfig": {
77
+ "provenance": true,
78
+ "registry": "https://registry.npmjs.org/"
79
+ },
80
+ "codexSkill": {
81
+ "name": "github-manage-security-alerts",
82
+ "path": ".",
83
+ "githubReleaseAssetPrefix": "github-security-codescanning-alerts-skill"
84
+ }
50
85
  }