[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CANRS7STSNF2C7BGFMQP5R":3,"skill-same:01M6CANRS7STSNF2C7BGFMQP5R":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":53,"linkOnly":54,"markdownContent":55,"markdownBody":56,"frontMatter":57,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":89,"repositoryHtmlUrl":90,"repositoryHomepageUrl":91,"ownerHtmlUrl":92,"ownerBlogUrl":93,"ownerDescription":94,"updatedAt":95,"install":96,"resources":108},"01M6CANRS7STSNF2C7BGFMQP5R","security-disclosure-track",null,"Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-disclosure-track\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52],"track","security disclosure track","security","write","transition","closure","reviews","encrypted","chain","project","efficiency","default","issue","reports","evidence","fix","read","timestamp","node","haiku","decision","coordination","text","Bash","vulnerability","publish","email","cve","git","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: security-disclosure-track\nplatforms: [all]\ndescription: Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure\nrequires:\n  - case-record: .aiwg\u002Fsecurity-engineering\u002Freviews\u002Fdisclosures\u002F\u003Ccase-id>.md\n  - private-channel: configured advisory, private issue, encrypted email, or encrypted form\nensures:\n  - custody-log: every transition records actor, timestamp, evidence, and next deadline\n  - disclosure-plan: coordinated-disclosure dates and publication checklist\nerrors:\n  - public-channel: refuses to publish private report details to public tracker channels before disclosure\ninvariants:\n  - embargoed details stay out of public issue threads and commits\n  - chain-of-custody record is git-ignored by default\nscript:\n  entrypoint: scripts\u002Ftrack.mjs\n  runtime: node\n  cwd: project-root\n  argsHint: \"\u003Ccase-id> [--stage triage|fix|cve|publish|close] [--evidence \u003Ctext>] [--decision \u003Ctext>] [--next-deadline \u003Cdate>] [--embargo-days N]\"\ncommandHint:\n  argumentHint: \"\u003Ccase-id> [--stage triage|fix|cve|publish|close] [--embargo-days N]\"\n  allowedTools: Read, Write, Bash\n  model: haiku\n  category: security\n  orchestration: true\n  modelRole: efficiency\n  modelTier: economy\n---\n\n# Security Disclosure Track\n\nManage the advisory lifecycle after `security-report` intake. This is the closure-loop companion for private vulnerability disclosure and completes curl Practice 27 coverage.\n\n## Stages\n\n1. **Triage**: validate scope, severity, affected versions, reproduction, reporter contact, and embargo clock.\n2. **Fix**: create private implementation plan; avoid public issue leakage; record commits\u002Fpatches by hash.\n3. **CVE**: determine whether CVE assignment is needed; record CNA\u002Fcontact path.\n4. **Publication**: prepare advisory, patched versions, acknowledgements, and release notes.\n5. **Close**: confirm disclosure complete, custody record finalized, public advisory linked.\n\n## Custody Record\n\nRecords live under `.aiwg\u002Fsecurity-engineering\u002Freviews\u002Fdisclosures\u002F` and are ignored by default. Each transition appends timestamp, actor, evidence, decision, and next deadline.\n\n## References\n\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-report\u002FSKILL.md`\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Ftemplates\u002FSECURITY.md`\n","# Security Disclosure Track\n\nManage the advisory lifecycle after `security-report` intake. This is the closure-loop companion for private vulnerability disclosure and completes curl Practice 27 coverage.\n\n## Stages\n\n1. **Triage**: validate scope, severity, affected versions, reproduction, reporter contact, and embargo clock.\n2. **Fix**: create private implementation plan; avoid public issue leakage; record commits\u002Fpatches by hash.\n3. **CVE**: determine whether CVE assignment is needed; record CNA\u002Fcontact path.\n4. **Publication**: prepare advisory, patched versions, acknowledgements, and release notes.\n5. **Close**: confirm disclosure complete, custody record finalized, public advisory linked.\n\n## Custody Record\n\nRecords live under `.aiwg\u002Fsecurity-engineering\u002Freviews\u002Fdisclosures\u002F` and are ignored by default. Each transition appends timestamp, actor, evidence, decision, and next deadline.\n\n## References\n\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-report\u002FSKILL.md`\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Ftemplates\u002FSECURITY.md`\n",{"name":5,"errors":58,"script":61,"ensures":65,"requires":70,"namespace":75,"platforms":76,"invariants":78,"commandHint":81,"description":7},[59],{"public-channel":60},"refuses to publish private report details to public tracker channels before disclosure",{"cwd":62,"runtime":42,"argsHint":63,"entrypoint":64},"project-root","\u003Ccase-id> [--stage triage|fix|cve|publish|close] [--evidence \u003Ctext>] [--decision \u003Ctext>] [--next-deadline \u003Cdate>] [--embargo-days N]","scripts\u002Ftrack.mjs",[66,68],{"custody-log":67},"every transition records actor, timestamp, evidence, and next deadline",{"disclosure-plan":69},"coordinated-disclosure dates and publication checklist",[71,73],{"case-record":72},".aiwg\u002Fsecurity-engineering\u002Freviews\u002Fdisclosures\u002F\u003Ccase-id>.md",{"private-channel":74},"configured advisory, private issue, encrypted email, or encrypted form","aiwg",[77],"all",[79,80],"embargoed details stay out of public issue threads and commits","chain-of-custody record is git-ignored by default",{"model":43,"category":26,"modelRole":34,"modelTier":82,"allowedTools":83,"argumentHint":84,"orchestration":85},"economy","Read, Write, Bash","\u003Ccase-id> [--stage triage|fix|cve|publish|close] [--embargo-days N]",true,"main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-disclosure-track",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-12 00:33:10",{"source":8,"skillName":5,"commands":97,"prompt":107,"zipAvailable":85},[98,101,104],{"tool":99,"command":100},"npx","npx skills add jmagly\u002Faiwg --skill security-disclosure-track",{"tool":102,"command":103},"bunx","bunx skills add jmagly\u002Faiwg --skill security-disclosure-track",{"tool":105,"command":106},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill security-disclosure-track","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-disclosure-track\u002FSKILL.md",[109],{"path":64,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"SCRIPT","脚本",2184,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-disclosure-track\u002Fscripts\u002Ftrack.mjs",[115,141,164,170,177,191],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":53},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[123,124,125,40,126,127,128,129,130,131,47,132,133,134,135,136,137,138,139,140],"host","host hardening","hardening","re","recommendations","remediation","plan","port","verification","access","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":151,"publishedAt":53},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[147,150],{"categoryNo":148,"categoryName":149,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[152,153,154,40,155,130,156,157,47,158,123,159,133,160,161,136,137,162,163,27],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator",{"skillNo":165,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":169,"publishedAt":53},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[168],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[125,123,124,132,40,140,128,127,135,129,130,131,47,139,133,134,126,136,137,138],{"skillNo":171,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":176,"publishedAt":53},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[174,175],{"categoryNo":148,"categoryName":149,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,152,136,155,130,156,47,154,123,159,133,160,161,40,137,158,157,162,163,27],{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":184,"publishedAt":53},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[183],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[185,186,187,188,189,190],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":53},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[197],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[199,200,160,201,186],"pi","pi local","duplicate"]