github-manage-security-alerts-skill 1.0.2 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CONTRIBUTING.md +7 -7
  2. package/README.md +5 -5
  3. package/SKILL.md +11 -10
  4. package/agents/openai.yaml +6 -6
  5. package/package.json +83 -57
package/CONTRIBUTING.md CHANGED
@@ -1,10 +1,10 @@
1
- ## Contributing to GitHub Security Alerts Skill
1
+ # Contributing to GitHub Security Alerts Skill
2
2
 
3
3
  Thanks for contributing.
4
4
 
5
5
  This repository is primarily a skill + helper tooling repo, so high-signal docs and safe defaults matter as much as code changes.
6
6
 
7
- ### Development setup
7
+ ## Development setup
8
8
 
9
9
  1. Clone the repository.
10
10
  2. Ensure Python 3.10+ is available.
@@ -17,7 +17,7 @@ python -m venv .venv
17
17
  .\.venv\Scripts\Activate.ps1
18
18
  ```
19
19
 
20
- ### Local sanity checks
20
+ ## Local sanity checks
21
21
 
22
22
  From repo root, run:
23
23
 
@@ -28,20 +28,20 @@ python "scripts/manage_github_security_alerts.py" --help
28
28
 
29
29
  If you touched command behavior, include example command invocations and expected output snippets in your PR description.
30
30
 
31
- ### Security requirements
31
+ ## Security requirements
32
32
 
33
33
  - **Do not** commit secrets.
34
34
  - **Do not** pass GitHub tokens as CLI literals.
35
35
  - Use environment variables (`GITHUB_TOKEN`, `GH_TOKEN`, or `--token-env`).
36
36
  - Prefer `--dry-run` for mutation commands in docs/examples.
37
37
 
38
- ### Commit messages
38
+ ## Commit messages
39
39
 
40
40
  This repo includes commit message conventions in:
41
41
 
42
- - `.github/copilot-commit-message-instructions.md`
42
+ - `.github/agent-commit-message-instructions.md`
43
43
 
44
- ### Pull request checklist
44
+ ## Pull request checklist
45
45
 
46
46
  - [ ] Documentation updated (README/SKILL/help text as needed)
47
47
  - [ ] Commands in docs are still valid
package/README.md CHANGED
@@ -182,11 +182,11 @@ This repository includes a release workflow that creates a downloadable zip bund
182
182
 
183
183
  - Workflow: `.github/workflows/release-skill.yml`
184
184
  - Trigger:
185
- - push a tag like `v0.1.0`
186
- - run manually via **workflow_dispatch** with:
187
- - `release_type`: `patch` / `minor` / `major`
188
- - `version`: optional explicit `x.y.z` (overrides `release_type`)
189
- - `ref`: branch to release from (default `main`)
185
+ - push a tag like `v0.1.0`
186
+ - run manually via **workflow_dispatch** with:
187
+ - `release_type`: `patch` / `minor` / `major`
188
+ - `version`: optional explicit `x.y.z` (overrides `release_type`)
189
+ - `ref`: branch to release from (default `main`)
190
190
  - Asset: `github-security-codescanning-alerts-skill-<tag>.zip`
191
191
 
192
192
  Examples:
package/SKILL.md CHANGED
@@ -1,9 +1,8 @@
1
1
  ---
2
- name: "github-manage-security-alerts"
3
- description: "Use when a user asks to inspect, triage, bulk-fix, bulk-dismiss, dismiss, reopen, resolve, assign, summarize, export, or configure GitHub repository security alerts across repositories, including code scanning, Dependabot, Dependabot malware, and secret scanning; securely reads the GitHub token from environment variables such as GITHUB_TOKEN"
2
+ name: github-manage-security-alerts
3
+ description: Use when the user asks to inspect, triage, summarize, export, or safely update GitHub security alerts for code scanning, Dependabot, malware, or secret scanning.
4
4
  license: "Unlicense"
5
- metadata:
6
- short-description: "Inspect and triage GitHub security alerts"
5
+ metadata: { "short-description": "Inspect and triage GitHub security alerts" }
7
6
  ---
8
7
 
9
8
  # GitHub Security Alerts Management
@@ -29,7 +28,7 @@ The bundled helper is repository-agnostic:
29
28
  - let it auto-detect `owner/repo` and the GitHub host from the git remote
30
29
  - or pass `--repository owner/repo` explicitly
31
30
  - authenticate via environment variable instead of putting a token on the command line
32
- - optionally override the API base URL for custom environments
31
+ - optionally override the API or web base URL for custom environments
33
32
 
34
33
  ## Compatibility
35
34
 
@@ -40,12 +39,13 @@ Supports GitHub.com and standard GHES API base URL derivation from git remotes,
40
39
  ## Invocation hints
41
40
 
42
41
  Use `repo` when the target is a local checkout, defaulting to `.`.
43
- Use optional `repository` and `token_env` values when auto-detection is not enough.
42
+ Use optional `repository`, `api_base_url`, `web_base_url`, and `token_env` values when auto-detection is not enough.
44
43
  Common commands include `summary`, `export-alerts`, `bulk-update-alerts`, `repo-security-overview`, `list-code-scanning`, `show-code-scanning`, `update-code-scanning`, `list-dependabot`, `show-dependabot`, `update-dependabot`, `list-malware`, `show-malware`, `update-malware`, `list-secret-scanning`, `show-secret-scanning`, `update-secret-scanning`, `list-secret-locations`, `secret-scan-history`, and `api-call`.
45
44
 
46
45
  ## Security model
47
46
 
48
47
  Do not paste GitHub tokens into command arguments.
48
+ Do not use `--show-secret-values` unless the user explicitly asks for unredacted secret values and confirms the exposure risk. Prefer redacted alert metadata, secret locations, validity, and resolution state. If unredacted output is required for remediation, do not paste secret material into chat, issue comments, PRs, commits, logs, or saved reports.
49
49
 
50
50
  Preferred pattern:
51
51
 
@@ -67,6 +67,7 @@ python "<path-to-skill>/scripts/manage_github_security_alerts.py" summary --repo
67
67
  - `repo`: path inside the target repository checkout (default `.`)
68
68
  - `repository`: optional explicit `owner/repo` override
69
69
  - `api_base_url`: optional explicit API base URL override
70
+ - `web_base_url`: optional explicit web base URL override for rendered links
70
71
  - `token_env`: optional environment variable name containing the token; repeatable for fallbacks
71
72
  - `json`: optional machine-readable output flag
72
73
 
@@ -74,13 +75,13 @@ python "<path-to-skill>/scripts/manage_github_security_alerts.py" summary --repo
74
75
 
75
76
  GitHub surfaces malware findings as **Dependabot malware alerts**.
76
77
 
77
- There is not a separate repository alert family with its own dedicated REST surface. The bundled helper therefore treats malware as a filtered subset of Dependabot alerts and cross-references each alert's advisory GHSA against the GitHub Advisory Database to identify advisories whose type is `malware`.
78
+ GitHub does not provide a separate repository alert family with its own dedicated REST surface. The bundled helper therefore treats malware as a filtered subset of Dependabot alerts and cross-references each alert's advisory GHSA against the GitHub Advisory Database to identify advisories whose type is `malware`.
78
79
 
79
80
  That means:
80
81
 
81
82
  - `list-malware`, `show-malware`, and `update-malware` are backed by Dependabot alert APIs
82
83
  - malware classification is strongest on GitHub.com, where the advisory database endpoint is available
83
- - if advisory type lookup is unavailable on the target host, the helper reports that clearly instead of silently guessing
84
+ - if advisory type lookup is unavailable on the target host, the helper reports that state instead of silently guessing
84
85
 
85
86
  ## Quick start
86
87
 
@@ -150,7 +151,7 @@ python "<path-to-skill>/scripts/manage_github_security_alerts.py" list-malware -
150
151
  python "<path-to-skill>/scripts/manage_github_security_alerts.py" list-secret-scanning --repo "." --state open
151
152
  ```
152
153
 
153
- Secret values are hidden by default.
154
+ Secret values are hidden by default. Keep that default unless the user explicitly confirms that unredacted secret output is necessary.
154
155
 
155
156
  ### 9. Resolve or reopen a secret scanning alert
156
157
 
@@ -190,7 +191,7 @@ python "<path-to-skill>/scripts/manage_github_security_alerts.py" api-call --rep
190
191
  - Fix real defects in code or dependency configuration when appropriate.
191
192
  - Dismiss only when you have a clear justification.
192
193
  - Reopen alerts when the earlier dismissal or resolution is no longer valid.
193
- - Use `bulk-update-alerts` when a repository has dozens or hundreds of obviously mis-triaged alerts that need the same action.
194
+ - Use `bulk-update-alerts` when a repository has dozens or hundreds of already-reviewed, mis-triaged alerts that need the same action.
194
195
  5. Apply mutations carefully.
195
196
  - Prefer `--dry-run` first for risky changes.
196
197
  - Add a short, actionable dismissal or resolution comment.
package/agents/openai.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  interface:
2
- display_name: "GitHub Manage Security Alerts"
3
- short_description: "Inspect and triage GitHub security alerts"
4
- icon_small: "./assets/github-manage-security-alerts-small.svg"
5
- icon_large: "./assets/github-manage-security-alerts.png"
6
- brand_color: "#24292F"
7
- default_prompt: "Use $github-manage-security-alerts to inspect GitHub security alerts, summarize exposure, and apply safe triage actions."
2
+ display_name: "GitHub Manage Security Alerts"
3
+ short_description: "Inspect and triage GitHub security alerts"
4
+ icon_small: "./assets/github-manage-security-alerts-small.svg"
5
+ icon_large: "./assets/github-manage-security-alerts.png"
6
+ brand_color: "#24292F"
7
+ default_prompt: "Use $github-manage-security-alerts to inspect GitHub security alerts, summarize exposure, and apply safe triage actions."
package/package.json CHANGED
@@ -1,59 +1,85 @@
1
1
  {
2
- "name": "github-manage-security-alerts-skill",
3
- "version": "1.0.2",
4
- "private": false,
5
- "description": "Codex skill for inspecting and triaging GitHub security alerts.",
6
- "license": "Unlicense",
7
- "type": "module",
8
- "repository": {
9
- "type": "git",
10
- "url": "git+https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill.git"
11
- },
12
- "bugs": {
13
- "url": "https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/issues"
14
- },
15
- "homepage": "https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill#readme",
16
- "keywords": [
17
- "agent-skill",
18
- "agent-skills",
19
- "ai-agent",
20
- "claude-code",
21
- "code-scanning",
22
- "codex",
23
- "cursor",
24
- "dependabot",
25
- "gemini-cli",
26
- "github-security",
27
- "github-copilot",
28
- "openai",
29
- "opencode",
30
- "secret-scanning",
31
- "universal",
32
- "zed"
33
- ],
34
- "files": [
35
- "SKILL.md",
36
- "LICENSE.txt",
37
- "agents/",
38
- "assets/",
39
- "scripts/",
40
- "CHANGELOG.md",
41
- "CONTRIBUTING.md",
42
- "README.md",
43
- "SECURITY.md"
44
- ],
45
- "engines": {
46
- "node": ">=22.14"
47
- },
48
- "scripts": {
49
- "validate": "node tools/validate-skill-package.mjs",
50
- "pack:dry-run": "npm pack --dry-run",
51
- "publish:local": "npm run release:verify && npm publish --access public",
52
- "release:verify": "npm run validate && npm run pack:dry-run"
53
- },
54
- "codexSkill": {
55
- "name": "github-manage-security-alerts",
56
- "path": ".",
57
- "githubReleaseAssetPrefix": "github-security-codescanning-alerts-skill"
58
- }
2
+ "name": "github-manage-security-alerts-skill",
3
+ "version": "1.0.3",
4
+ "private": false,
5
+ "description": "Codex skill for inspecting and triaging GitHub security alerts.",
6
+ "keywords": [
7
+ "agent-skill",
8
+ "agent-skills",
9
+ "ai-agent",
10
+ "claude-code",
11
+ "code-scanning",
12
+ "codex",
13
+ "cursor",
14
+ "dependabot",
15
+ "gemini-cli",
16
+ "github-copilot",
17
+ "github-security",
18
+ "openai",
19
+ "openclaw",
20
+ "opencode",
21
+ "secret-scanning",
22
+ "universal",
23
+ "zed"
24
+ ],
25
+ "homepage": "https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill#readme",
26
+ "bugs": {
27
+ "url": "https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill/issues"
28
+ },
29
+ "repository": {
30
+ "type": "git",
31
+ "url": "git+https://github.com/Nick2bad4u/Github-Security-CodeScanning-Alerts-Skill.git"
32
+ },
33
+ "license": "Unlicense",
34
+ "author": "Nick2bad4u <20943337+Nick2bad4u@users.noreply.github.com> (https://github.com/Nick2bad4u)",
35
+ "contributors": [
36
+ {
37
+ "name": "Nick2bad4u",
38
+ "email": "20943337+Nick2bad4u@users.noreply.github.com",
39
+ "url": "https://github.com/Nick2bad4u"
40
+ }
41
+ ],
42
+ "type": "module",
43
+ "files": [
44
+ "SKILL.md",
45
+ "LICENSE.txt",
46
+ "agents/",
47
+ "assets/",
48
+ "scripts/",
49
+ "CHANGELOG.md",
50
+ "CONTRIBUTING.md",
51
+ "README.md",
52
+ "SECURITY.md"
53
+ ],
54
+ "scripts": {
55
+ "lint:package-json": "npmPkgJsonLint . --config .npmpackagejsonlintrc.json",
56
+ "lint:remark": "remark . --frail --ignore-path .remarkignore",
57
+ "lint:remark:fix": "remark . --ignore-path .remarkignore --output",
58
+ "pack:dry-run": "npm pack --dry-run",
59
+ "publish:local": "npm run release:verify && npm publish --access public",
60
+ "release:verify": "npm run validate && npm run pack:dry-run",
61
+ "update-actions": "npx actions-up --yes --style sha",
62
+ "validate": "node tools/validate-skill-package.mjs"
63
+ },
64
+ "devDependencies": {
65
+ "npm-package-json-lint": "^10.4.1",
66
+ "npm-package-json-lint-config-nick2bad4u": "^1.0.3",
67
+ "prettier": "^3.9.0",
68
+ "prettier-config-nick2bad4u": "^1.0.18",
69
+ "remark": "^15.0.1",
70
+ "remark-cli": "^12.0.1",
71
+ "remark-config-nick2bad4u": "^1.1.2"
72
+ },
73
+ "engines": {
74
+ "node": ">=22.14"
75
+ },
76
+ "publishConfig": {
77
+ "provenance": true,
78
+ "registry": "https://registry.npmjs.org/"
79
+ },
80
+ "codexSkill": {
81
+ "name": "github-manage-security-alerts",
82
+ "path": ".",
83
+ "githubReleaseAssetPrefix": "github-security-codescanning-alerts-skill"
84
+ }
59
85
  }