security-disclosure-track
Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure
- License 许可
- MIT
- 所属仓库
- jmagly/aiwg
- 最近更新
- 2026-11-12
- Stars
- ★ 229
- Forks
- 36
01 前言 Front Matter
- name
- security-disclosure-track
- errors
- [ { "public-channel": "refuses to publish private report details to public tracker channels before disclosure" } ]
- script
- { "cwd": "project-root", "runtime": "node", "argsHint": "<case-id> [--stage triage|fix|cve|publish|close] [--evidence <text>] [--decision <text>] [--next-deadline <date>] [--embargo-days N]", "entrypoint": "scripts/track.mjs" }
- ensures
- [ { "custody-log": "every transition records actor, timestamp, evidence, and next deadline" }, { "disclosure-plan": "coordinated-disclosure dates and publication checklist" } ]
- requires
- [ { "case-record": ".aiwg/security-engineering/reviews/disclosures/<case-id>.md" }, { "private-channel": "configured advisory, private issue, encrypted email, or encrypted form" } ]
- namespace
- aiwg
- platforms
- [ "all" ]
- invariants
- [ "embargoed details stay out of public issue threads and commits", "chain-of-custody record is git-ignored by default" ]
- commandHint
- { "model": "haiku", "category": "security", "modelRole": "efficiency", "modelTier": "economy", "allowedTools": "Read, Write, Bash", "argumentHint": "<case-id> [--stage triage|fix|cve|publish|close] [--embargo-days N]", "orchestration": true }
- description
- Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure
02 资源文件 1
- 脚本scripts/track.mjs2.1 KB
03 SKILL.md 正文
Security Disclosure Track
Manage the advisory lifecycle after security-report intake. This is the closure-loop companion for private vulnerability disclosure and completes curl Practice 27 coverage.
Stages
- Triage: validate scope, severity, affected versions, reproduction, reporter contact, and embargo clock.
- Fix: create private implementation plan; avoid public issue leakage; record commits/patches by hash.
- CVE: determine whether CVE assignment is needed; record CNA/contact path.
- Publication: prepare advisory, patched versions, acknowledgements, and release notes.
- Close: confirm disclosure complete, custody record finalized, public advisory linked.
Custody Record
Records live under .aiwg/security-engineering/reviews/disclosures/ and are ignored by default. Each transition appends timestamp, actor, evidence, decision, and next deadline.
References
agentic/code/frameworks/security-engineering/skills/security-report/SKILL.mdagentic/code/frameworks/security-engineering/templates/SECURITY.md
04 同仓库更多 Skills
host-hardening
Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.
exposure-analysis
Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.
host-hardening
Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.
exposure-analysis
Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.
fixture-skill
Exercise rule delivery.
pi-local
Pi-local duplicate-precedence fixture.