[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C2G07CWK8MJQW689XYJ5GS":3,"skill-same:01M6C2G07CWK8MJQW689XYJ5GS":115},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":54,"linkOnly":55,"markdownContent":56,"markdownBody":57,"frontMatter":58,"refName":87,"commitSha":88,"skillDirectory":89,"forksCount":90,"repositoryHtmlUrl":91,"repositoryHomepageUrl":92,"ownerHtmlUrl":93,"ownerBlogUrl":94,"ownerDescription":95,"updatedAt":96,"install":97,"resources":109},"01M6C2G07CWK8MJQW689XYJ5GS","security-disclosure-track",null,"Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-disclosure-track\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53],"track","security disclosure track","security","read","transition","closure","reviews","encrypted","chain","project","efficiency","default","reports","evidence","fix","write","timestamp","node","haiku","decision","coordination","text","Bash","commits","vulnerability","chain-of-custody","publish","email","cve","git","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: security-disclosure-track\nplatforms: [all]\ndescription: Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure\nrequires:\n  - case-record: .aiwg\u002Fsecurity-engineering\u002Freviews\u002Fdisclosures\u002F\u003Ccase-id>.md\n  - private-channel: configured advisory, private issue, encrypted email, or encrypted form\nensures:\n  - custody-log: every transition records actor, timestamp, evidence, and next deadline\n  - disclosure-plan: coordinated-disclosure dates and publication checklist\nerrors:\n  - public-channel: refuses to publish private report details to public tracker channels before disclosure\ninvariants:\n  - embargoed details stay out of public issue threads and commits\n  - chain-of-custody record is git-ignored by default\nscript:\n  entrypoint: scripts\u002Ftrack.mjs\n  runtime: node\n  cwd: project-root\n  argsHint: \"\u003Ccase-id> [--stage triage|fix|cve|publish|close] [--evidence \u003Ctext>] [--decision \u003Ctext>] [--next-deadline \u003Cdate>] [--embargo-days N]\"\ncommandHint:\n  argumentHint: \"\u003Ccase-id> [--stage triage|fix|cve|publish|close] [--embargo-days N]\"\n  allowedTools: Read, Write, Bash\n  model: haiku\n  category: security\n  orchestration: true\n  modelRole: efficiency\n  modelTier: economy\n---\n\n# Security Disclosure Track\n\nManage the advisory lifecycle after `security-report` intake. This is the closure-loop companion for private vulnerability disclosure and completes curl Practice 27 coverage.\n\n## Stages\n\n1. **Triage**: validate scope, severity, affected versions, reproduction, reporter contact, and embargo clock.\n2. **Fix**: create private implementation plan; avoid public issue leakage; record commits\u002Fpatches by hash.\n3. **CVE**: determine whether CVE assignment is needed; record CNA\u002Fcontact path.\n4. **Publication**: prepare advisory, patched versions, acknowledgements, and release notes.\n5. **Close**: confirm disclosure complete, custody record finalized, public advisory linked.\n\n## Custody Record\n\nRecords live under `.aiwg\u002Fsecurity-engineering\u002Freviews\u002Fdisclosures\u002F` and are ignored by default. Each transition appends timestamp, actor, evidence, decision, and next deadline.\n\n## References\n\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-report\u002FSKILL.md`\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Ftemplates\u002FSECURITY.md`\n","# Security Disclosure Track\n\nManage the advisory lifecycle after `security-report` intake. This is the closure-loop companion for private vulnerability disclosure and completes curl Practice 27 coverage.\n\n## Stages\n\n1. **Triage**: validate scope, severity, affected versions, reproduction, reporter contact, and embargo clock.\n2. **Fix**: create private implementation plan; avoid public issue leakage; record commits\u002Fpatches by hash.\n3. **CVE**: determine whether CVE assignment is needed; record CNA\u002Fcontact path.\n4. **Publication**: prepare advisory, patched versions, acknowledgements, and release notes.\n5. **Close**: confirm disclosure complete, custody record finalized, public advisory linked.\n\n## Custody Record\n\nRecords live under `.aiwg\u002Fsecurity-engineering\u002Freviews\u002Fdisclosures\u002F` and are ignored by default. Each transition appends timestamp, actor, evidence, decision, and next deadline.\n\n## References\n\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-report\u002FSKILL.md`\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Ftemplates\u002FSECURITY.md`\n",{"name":5,"errors":59,"script":62,"ensures":66,"requires":71,"namespace":76,"platforms":77,"invariants":79,"commandHint":82,"description":7},[60],{"public-channel":61},"refuses to publish private report details to public tracker channels before disclosure",{"cwd":63,"runtime":41,"argsHint":64,"entrypoint":65},"project-root","\u003Ccase-id> [--stage triage|fix|cve|publish|close] [--evidence \u003Ctext>] [--decision \u003Ctext>] [--next-deadline \u003Cdate>] [--embargo-days N]","scripts\u002Ftrack.mjs",[67,69],{"custody-log":68},"every transition records actor, timestamp, evidence, and next deadline",{"disclosure-plan":70},"coordinated-disclosure dates and publication checklist",[72,74],{"case-record":73},".aiwg\u002Fsecurity-engineering\u002Freviews\u002Fdisclosures\u002F\u003Ccase-id>.md",{"private-channel":75},"configured advisory, private issue, encrypted email, or encrypted form","aiwg",[78],"all",[80,81],"embargoed details stay out of public issue threads and commits","chain-of-custody record is git-ignored by default",{"model":42,"category":26,"modelRole":34,"modelTier":83,"allowedTools":84,"argumentHint":85,"orchestration":86},"economy","Read, Write, Bash","\u003Ccase-id> [--stage triage|fix|cve|publish|close] [--embargo-days N]",true,"main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-disclosure-track",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-14 10:46:34",{"source":8,"skillName":5,"commands":98,"prompt":108,"zipAvailable":86},[99,102,105],{"tool":100,"command":101},"npx","npx skills add jmagly\u002Faiwg --skill security-disclosure-track",{"tool":103,"command":104},"bunx","bunx skills add jmagly\u002Faiwg --skill security-disclosure-track",{"tool":106,"command":107},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill security-disclosure-track","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-disclosure-track\u002FSKILL.md",[110],{"path":65,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"SCRIPT","脚本",2184,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-disclosure-track\u002Fscripts\u002Ftrack.mjs",[116,142,165,171,178,192],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":54},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[122],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[124,125,126,27,127,128,129,130,131,132,46,133,134,135,136,137,138,139,140,141],"host","host hardening","hardening","re","recommendations","remediation","plan","port","verification","access","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":152,"publishedAt":54},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[148,151],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,154,155,27,156,131,157,158,46,159,124,160,134,161,162,137,138,163,164,39],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator",{"skillNo":166,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":170,"publishedAt":54},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[169],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[126,124,125,133,27,141,129,128,136,130,131,132,46,140,134,135,127,137,138,139],{"skillNo":172,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":177,"publishedAt":54},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[175,176],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[154,153,137,156,131,157,46,155,124,160,134,161,162,27,138,159,158,163,164,39],{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":185,"publishedAt":54},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[184],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[186,187,188,189,190,191],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":54},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[198],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[200,201,161,202,187],"pi","pi local","duplicate"]