[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AD7TNQ2GDMZQEB0S8G1DBF":3,"skill-same:01M6AD7TNQ2GDMZQEB0S8G1DBF":58},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":37,"repositoryHtmlUrl":38,"repositoryHomepageUrl":39,"ownerHtmlUrl":40,"ownerBlogUrl":41,"ownerDescription":42,"updatedAt":43,"install":44,"resources":57},"01M6AD7TNQ2GDMZQEB0S8G1DBF","security-advisory-compat-enforcer",null,"Review a GitHub security advisory and safely update .github\u002Faw\u002Fcompat.json with evidence-backed version enforcement.","github\u002Fgh-aw","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3VCZ4WKQSFSRTPN7N9DN",5621,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fsecurity-advisory-compat-enforcer\u002FSKILL.md",[],[19,20,21,22,9,23,24,25,26,27,28],"security","security advisory compat enforcer","advisory","review","update","json","version","evidence","enforcement","with","2026-11-10 10:12:30",false,"---\nname: security-advisory-compat-enforcer\ndescription: Review a GitHub security advisory and safely update .github\u002Faw\u002Fcompat.json with evidence-backed version enforcement.\n---\n\n# Security Advisory Compatibility Enforcer\n\nUse this skill to translate a GitHub repository security advisory into the\nsmallest safe update to `.github\u002Faw\u002Fcompat.json`.\n\n## Required inputs\n\nRecord the repository, GHSA identifier, requested enforcement policy, and any\npatched version supplied by the user. Treat a user-supplied version as a target\nto verify, not as evidence for advisory details.\n\n## Evidence retrieval\n\n1. Attempt authenticated retrieval first:\n   `gh api repos\u002FOWNER\u002FREPO\u002Fsecurity-advisories\u002FGHSA-ID`.\n2. If authentication is unavailable or access fails, try the public global\n   advisory endpoint: `gh api advisories\u002FGHSA-ID` (or its equivalent REST URL).\n3. Record the endpoint and outcome of each attempt. If both sources are\n   inaccessible, state that explicitly. Never infer or invent the affected\n   package, vulnerable range, severity, CVE, publication state, or patched\n   version.\n4. Verify the proposed patched version independently. Prefer a published\n   repository release or tag, then package-registry metadata when applicable.\n   Cite the exact URL or command result. Do not update compatibility policy if\n   the target cannot be verified, unless the user explicitly directs use of a\n   supplied target despite inaccessible advisory metadata; document that\n   limitation without converting it into fabricated advisory evidence.\n\n## Choose the correct policy field\n\n- `minimumVersion` is a hard floor: activation fails for every compiler version\n  below it. Change it only when the requested remediation is a universal\n  minimum-version enforcement.\n- `blockedVersions` rejects listed versions exactly. Change it only when\n  evidence or explicit instructions identify exact versions to deny and a\n  continuous minimum floor would be inaccurate.\n- `minRecommendedVersion` only warns below the value. Change it only for an\n  explicitly requested recommendation, never as a substitute for enforcement.\n- Agent rows under `agent-compat-v1` select compatible agent versions; they are\n  unrelated to compiler security enforcement unless separate evidence requires\n  an agent compatibility change.\n\n## Write remediation guidance\n\nProvide concise, actionable remediation in `.github\u002Faw\u002Fcompat.md` and the final\nreport. Follow established security-advisory terminology:\n\n1. Identify the affected product or component, GHSA identifier, CVE identifier\n   when assigned, affected versions, and first fixed or unaffected version.\n   Use exact bounded ranges and do not broaden the advisory's claims.\n2. State the permanent remediation in imperative language. Give exact,\n   copyable upgrade and regeneration commands verified against official\n   documentation. For compiler advisories, explain whether existing generated\n   workflows must be recompiled and redeployed; blocking a vulnerable version\n   prevents execution but does not repair generated artifacts.\n3. Separate remediation from mitigations and workarounds. Include a temporary\n   measure only when the advisory documents it. If the retrieved advisory does\n   not identify one, say so without claiming that no workaround exists.\n4. Include a verification step that checks the installed version and any\n   regenerated artifacts. Do not treat a successful install alone as proof that\n   deployed workflows were remediated.\n5. Link the advisory, fixed release, and authoritative upgrade documentation.\n   Mention severity, CVSS, known exploitation, CISA KEV status, deadlines, or\n   urgency only when verified from authoritative evidence.\n\nDo not invent commands, CVE identifiers, affected configurations, mitigations,\nor timelines. If remediation details cannot be verified, identify the missing\nevidence and leave the instructions explicitly incomplete.\n\n## Safe edit procedure\n\n1. Parse the current JSON and record all four policy areas above.\n2. Compare semantic versions numerically. A minimum is monotonic: never lower a\n   non-empty `minimumVersion` or `minRecommendedVersion`. Stop and report a\n   requested downgrade rather than applying it.\n3. Make the narrowest evidence-backed edit. Preserve `blockedVersions`,\n   `minRecommendedVersion`, every `agent-compat-v1` row, key ordering, and\n   formatting unless the selected policy specifically requires changing them.\n4. When changing `blockedVersions`, update `.github\u002Faw\u002Fcompat.md` in the same\n   change. Account for every blocked version, state why each version or\n   contiguous range is blocked, link to the corresponding advisory, and provide\n   the remediation and verification steps defined above.\n5. Review the final diff and reject unrelated changes.\n\n## Required validation\n\nBefore reporting completion:\n\n1. Run the repository's `Validate compat.json structure and version formats`\n   task from `.github\u002Fworkflows\u002Fcgo.yml`.\n2. Validate `.github\u002Faw\u002Fcompat.json` against\n   `.github\u002Faw\u002Fcompat.schema.json` with a JSON Schema Draft 7 validator. JSON\n   parsing or ad hoc field checks are not substitutes for schema validation.\n3. Confirm `.github\u002Faw\u002Fcompat.md` accounts for every `blockedVersions` entry\n   and that each documented range links to its advisory.\n4. Exercise the runtime policy semantics with versions immediately below, at,\n   and above the changed boundary; confirm only the intended hard-fail, warning,\n   or exact-block behavior changed.\n5. Confirm semantic-version monotonicity and byte-for-byte preservation of\n   unrelated policy fields and agent rows.\n\nDo not claim validation that was not run. If repository constraints prohibit a\nrequired check, report it as outstanding.\n\n## Report\n\nCite advisory retrieval attempts and patched-version verification. State which\nfield changed, old and new values, why that policy is correct, which fields were\npreserved, and the compatibility task, schema, documentation, and runtime\nvalidation results. Include the remediation, any advisory-supported temporary\nmitigation, and verification steps. Clearly separate verified facts,\nuser-provided inputs, and unavailable advisory details.\n","# Security Advisory Compatibility Enforcer\n\nUse this skill to translate a GitHub repository security advisory into the\nsmallest safe update to `.github\u002Faw\u002Fcompat.json`.\n\n## Required inputs\n\nRecord the repository, GHSA identifier, requested enforcement policy, and any\npatched version supplied by the user. Treat a user-supplied version as a target\nto verify, not as evidence for advisory details.\n\n## Evidence retrieval\n\n1. Attempt authenticated retrieval first:\n   `gh api repos\u002FOWNER\u002FREPO\u002Fsecurity-advisories\u002FGHSA-ID`.\n2. If authentication is unavailable or access fails, try the public global\n   advisory endpoint: `gh api advisories\u002FGHSA-ID` (or its equivalent REST URL).\n3. Record the endpoint and outcome of each attempt. If both sources are\n   inaccessible, state that explicitly. Never infer or invent the affected\n   package, vulnerable range, severity, CVE, publication state, or patched\n   version.\n4. Verify the proposed patched version independently. Prefer a published\n   repository release or tag, then package-registry metadata when applicable.\n   Cite the exact URL or command result. Do not update compatibility policy if\n   the target cannot be verified, unless the user explicitly directs use of a\n   supplied target despite inaccessible advisory metadata; document that\n   limitation without converting it into fabricated advisory evidence.\n\n## Choose the correct policy field\n\n- `minimumVersion` is a hard floor: activation fails for every compiler version\n  below it. Change it only when the requested remediation is a universal\n  minimum-version enforcement.\n- `blockedVersions` rejects listed versions exactly. Change it only when\n  evidence or explicit instructions identify exact versions to deny and a\n  continuous minimum floor would be inaccurate.\n- `minRecommendedVersion` only warns below the value. Change it only for an\n  explicitly requested recommendation, never as a substitute for enforcement.\n- Agent rows under `agent-compat-v1` select compatible agent versions; they are\n  unrelated to compiler security enforcement unless separate evidence requires\n  an agent compatibility change.\n\n## Write remediation guidance\n\nProvide concise, actionable remediation in `.github\u002Faw\u002Fcompat.md` and the final\nreport. Follow established security-advisory terminology:\n\n1. Identify the affected product or component, GHSA identifier, CVE identifier\n   when assigned, affected versions, and first fixed or unaffected version.\n   Use exact bounded ranges and do not broaden the advisory's claims.\n2. State the permanent remediation in imperative language. Give exact,\n   copyable upgrade and regeneration commands verified against official\n   documentation. For compiler advisories, explain whether existing generated\n   workflows must be recompiled and redeployed; blocking a vulnerable version\n   prevents execution but does not repair generated artifacts.\n3. Separate remediation from mitigations and workarounds. Include a temporary\n   measure only when the advisory documents it. If the retrieved advisory does\n   not identify one, say so without claiming that no workaround exists.\n4. Include a verification step that checks the installed version and any\n   regenerated artifacts. Do not treat a successful install alone as proof that\n   deployed workflows were remediated.\n5. Link the advisory, fixed release, and authoritative upgrade documentation.\n   Mention severity, CVSS, known exploitation, CISA KEV status, deadlines, or\n   urgency only when verified from authoritative evidence.\n\nDo not invent commands, CVE identifiers, affected configurations, mitigations,\nor timelines. If remediation details cannot be verified, identify the missing\nevidence and leave the instructions explicitly incomplete.\n\n## Safe edit procedure\n\n1. Parse the current JSON and record all four policy areas above.\n2. Compare semantic versions numerically. A minimum is monotonic: never lower a\n   non-empty `minimumVersion` or `minRecommendedVersion`. Stop and report a\n   requested downgrade rather than applying it.\n3. Make the narrowest evidence-backed edit. Preserve `blockedVersions`,\n   `minRecommendedVersion`, every `agent-compat-v1` row, key ordering, and\n   formatting unless the selected policy specifically requires changing them.\n4. When changing `blockedVersions`, update `.github\u002Faw\u002Fcompat.md` in the same\n   change. Account for every blocked version, state why each version or\n   contiguous range is blocked, link to the corresponding advisory, and provide\n   the remediation and verification steps defined above.\n5. Review the final diff and reject unrelated changes.\n\n## Required validation\n\nBefore reporting completion:\n\n1. Run the repository's `Validate compat.json structure and version formats`\n   task from `.github\u002Fworkflows\u002Fcgo.yml`.\n2. Validate `.github\u002Faw\u002Fcompat.json` against\n   `.github\u002Faw\u002Fcompat.schema.json` with a JSON Schema Draft 7 validator. JSON\n   parsing or ad hoc field checks are not substitutes for schema validation.\n3. Confirm `.github\u002Faw\u002Fcompat.md` accounts for every `blockedVersions` entry\n   and that each documented range links to its advisory.\n4. Exercise the runtime policy semantics with versions immediately below, at,\n   and above the changed boundary; confirm only the intended hard-fail, warning,\n   or exact-block behavior changed.\n5. Confirm semantic-version monotonicity and byte-for-byte preservation of\n   unrelated policy fields and agent rows.\n\nDo not claim validation that was not run. If repository constraints prohibit a\nrequired check, report it as outstanding.\n\n## Report\n\nCite advisory retrieval attempts and patched-version verification. State which\nfield changed, old and new values, why that policy is correct, which fields were\npreserved, and the compatibility task, schema, documentation, and runtime\nvalidation results. Include the remediation, any advisory-supported temporary\nmitigation, and verification steps. Clearly separate verified facts,\nuser-provided inputs, and unavailable advisory details.\n",{"name":5,"description":7},"main","8541229759617347888641eba917d3b0ad66a984",".github\u002Fskills\u002Fsecurity-advisory-compat-enforcer",625,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw","https:\u002F\u002Fgh.io\u002Fgh-aw","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-12 03:23:28",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add github\u002Fgh-aw --skill security-advisory-compat-enforcer",{"tool":50,"command":51},"bunx","bunx skills add github\u002Fgh-aw --skill security-advisory-compat-enforcer",{"tool":53,"command":54},"pnpm","pnpm dlx skills add github\u002Fgh-aw --skill security-advisory-compat-enforcer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fsecurity-advisory-compat-enforcer\u002FSKILL.md",true,[],[59,88,106,130,156,173],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":73,"publishedAt":29},"01M6ADC942STTXHFV410J4DH0X","GitHub Agentic Workflows","GitHub Agentic Workflows (`gh-aw`) is a GitHub CLI extension for writing Agentic Workflows in markdown and compiling them to GitHub Actions.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002FSKILL.md",[65,70],{"categoryNo":66,"categoryName":67,"taxonomyType":68,"taxonomyTypeDesc":69},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":71,"categoryName":72,"taxonomyType":68,"taxonomyTypeDesc":69},"01JBSEEDCAT000000000000023","Skill与智能体开发",[9,74,75,76,77,78,79,80,81,82,83,84,85,86,87],"agentic","agentic workflows","github agentic workflows","workflows","github cli","gh","extension","for","compiling","cli","writing","actions","github actions","markdown",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":29},"01M6ADC6ZXSA46N9XD6VNAP1MS","windows-compatibility","Cross-platform path handling and command patterns","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Fwindows-compatibility\u002FSKILL.md",[],[95,96,97,98,99,100,101,102,103,104,105],"windows","windows compatibility","compatibility","bugs","path","high","platform","cross-platform","patterns","command","git",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":29},"01M6ADC44957SVQF96R5YY247P","versioning-policy","Semver versioning rules for Squad SDK and CLI — prevents prerelease version incidents","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Fversioning-policy\u002FSKILL.md",[],[113,114,115,116,117,118,25,119,120,121,122,123,124,125,126,127,81,128,83,129],"policy","versioning policy","versioning","incident","gate","implementation","Rules","workspace","pr","ci","npm","semver","release","squad","resolution","incidents","sdk",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":140,"publishedAt":29},"01M6ADC1PHMEAEVR87F8PDR89X","tiered-memory","Three-tier agent memory model (hot\u002Fcold\u002Fwiki) for context reduction per spawn","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Ftiered-memory\u002FSKILL.md",[136,139],{"categoryNo":137,"categoryName":138,"taxonomyType":68,"taxonomyTypeDesc":69},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":71,"categoryName":72,"taxonomyType":68,"taxonomyTypeDesc":69},[141,142,143,144,81,145,146,147,148,149,150,151,152,153,154,155],"tiered memory","memory","memory-management","model","cold","proposal","runtime","three","spawn","management","context","wiki","agent memory","performance","design",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":165,"publishedAt":29},"01M6ADBZTDGFM0E25EWRQEMYEH","test-discipline","Update tests when changing APIs — no exceptions","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Ftest-discipline\u002FSKILL.md",[162],{"categoryNo":163,"categoryName":164,"taxonomyType":68,"taxonomyTypeDesc":69},"01JBSEEDCAT000000000000008","测试与质量",[166,167,168,169,170,100,171,116,172,23],"test discipline","discipline","test","sync","when","tests","quality",{"skillNo":174,"name":126,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":29},"01M6ADBX5MJP4Z7CG4XTV8ZVT8","Squad's command catalog and interactive menu. Invoke via \u002Fsquad (slash command) or natural language (\"squad commands\", \"what can squad do\", \"show me squad options\"). Presents categorized operations (Install & Upgrade, Team Management, Issues & PRs, Plugins & Skills, Model & Cost, Sessions & State) as an interactive picker. Routes to the right squad CLI command or the Squad coordinator agent.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Fsquad\u002FSKILL.md",[],[126,179,180,181,182,183,184,185,186,187,188,189,190,104,144,191,192,193,194,195,196,197,83],"show","interactive menu","invoke","coordinator","as","commands","upgrade","options","me","natural language","do","install","team","show me","plugins","issues","state","squad commands","sessions"]