[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71KW4S5MP70Y3EZBV6VNRTZ":3,"skill-same:01M71KW4S5MP70Y3EZBV6VNRTZ":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":50,"ownerDescription":6,"updatedAt":51,"install":52,"resources":65},"01M71KW4S5MP70Y3EZBV6VNRTZ","triage-security-issues",null,"Use when asked to coordinate triage and remediation of a repository's Dependabot malware\u002Fvulnerability, GitHub Code Scanning, GitHub Secret Scanning, and Codex Security cloud alerts. Not for starting a new scan or merely authoring or reviewing skills.","donadiosolutions\u002Flcm","donadiosolutions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F144397773?v=4","01M71KV7RZTX2KAPTB9NN513YW","Donadio Solutions","01M71KV7T4419Z0HTJQ3G3TYN2",4,"MIT","https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftriage-security-issues\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"triage","security","triage security issues","issues","remediation","scanning","github","codex","alerts","vulnerability","code","when","dependabot","use","new","secret","github code","scan","for","coordinate","2026-11-10 10:56:23",false,"---\nname: triage-security-issues\ndescription: Use when asked to coordinate triage and remediation of a repository's Dependabot malware\u002Fvulnerability, GitHub Code Scanning, GitHub Secret Scanning, and Codex Security cloud alerts. Not for starting a new scan or merely authoring or reviewing skills.\n---\n\n# Triage security issues\n\n## Contract and mandatory reuse\n\nExecution covers inventory, complete triage\u002Fgrouping, then remediation through\nverified source resolution, subject to narrower user limits. Authoring, reviewing,\nor testing this skill never starts a campaign or authorizes live alert mutations.\n\n**Invoke existing skills that implement the needed capability. Do not duplicate\ntheir natural-language procedures or copy their scripts.** This rule applies to\nauthors and executing agents. This wrapper owns only security-source acquisition,\nidentity, private accounting, cross-source grouping and source-resolution policy.\nInspect available skills\u002Fhelpers before adding code for a demonstrated gap; do not\nbuild another GitHub client, browser-session manager, campaign engine or delivery\nscript. Do not invoke `triage-fix-all-bugs`: its native Bug input contract differs.\n\nRead repository\u002Flocal instructions and [LCM integration](..\u002Fshared\u002Flcm-development.md).\nInvoke `lcm-memory` for required project context without storing raw findings or\ncredentials. Read [procedural-development](..\u002Fprocedural-development\u002FSKILL.md) and\nits coordination\u002Fdelivery references. Apply its\n[root lifecycle admission](..\u002Fprocedural-development\u002Freferences\u002Froot-lifecycle.md)\nbefore triage dispatch or unattended waiting. Every worker receives the\n[worker execution brief](..\u002Fprocedural-development\u002Freferences\u002Fworker-execution.md)\nand must supply its command completion\u002Fcleanup evidence.\n\nRead [sources](references\u002Fsources.md), [authentication](references\u002Fauthentication.md),\n[triage](references\u002Ftriage.md) and [accounting](references\u002Fcoordination.md) before\ncollection. These references supply caller policy, not replacement workflows.\nBefore collection or campaign dispatch, verify `gh auth status --hostname \u003Chost>`.\nIf unauthenticated, ask the user to run `gh auth login --hostname \u003Chost>` and wait\nbefore continuing. Recheck after they authenticate; do not open a GitHub browser\nlogin or acquire another credential source.\n\n## Configuration\n\nInvocation instructions, not CLI flags: `REPOSITORY` defaults to the checkout's\ncanonical GitHub host\u002Fowner\u002Frepository; `CODEX_CSV` optionally supplies a snapshot;\n`RESUME_RUN` selects an existing private campaign. A repository override must map\nto the inspected checkout before assessment. Default sources are the four in the\ndescription; never silently add Issues, advisories\u002Fprivate reports or new scans.\n\nCopy of the Alpha roster with mandatory security bindings:\n\n| ROLE | Model default | Reasoning default | Tier default |\n| --- | --- | --- | --- |\n| `TRIAGE` | `gpt-daybreak-blue-latest` | high | default |\n| `OWNER` | `gpt-5.6-sol` | medium | default |\n| `IMPLEMENTER` | `gpt-daybreak-blue-latest` | high | default |\n| `SECURITY_IMPLEMENTER` | `gpt-daybreak-blue-latest` | high | default |\n| `ESCALATED_IMPLEMENTER` | `gpt-daybreak-blue-latest` | high | default |\n| `REVIEWER_A` | `cortex-hq\u002Fzai-org-GLM-5.3` | maximum supported | default |\n| `REVIEWER_B` | `xai\u002Fgrok-4.6` | medium | default |\n| `SYNTHESIS_REVIEWER` | `anthropic\u002Fclaude-opus-5` | medium | default |\n\nResolve `\u003CROLE>_MODEL`, `\u003CROLE>_REASONING`, `\u003CROLE>_TIER` using shared precedence and\nroute preflight. Owner\u002Freviewer models are configurable. `TRIAGE`, `IMPLEMENTER`,\n`SECURITY_IMPLEMENTER` and `ESCALATED_IMPLEMENTER` must remain Daybreak Blue,\nincluding duplicate adjudication, validation and nested implementation calls.\nAn incompatible model override is a configuration conflict, not a fallback.\nInherit shared owner limits, candidate budgets and best-effort tier rules; do not\nredefine them. Record resolved values and pass them unchanged on resume\u002Fhandoff.\n\n## Skill invocation boundaries\n\nDiscover installed skills by these names and read their entrypoints before invoking\nthem. Missing required skills block that capability; do not recreate their workflow\ninline. External plugin paths are resolved from the active skill catalog, never\nhard-coded to this author's machine. The parent campaign owns dispatch and grouping;\n`triage-finding` runs inline inside its assigned Daybreak worker without nested\ntriage dispatch, dynamic tests, deduplication or source mutation.\n\n| Invoke | Input | Required evidence \u002F condition for continuing |\n| --- | --- | --- |\n| `lcm-memory` | Target project and bounded context question | Applicable context or recorded empty\u002Funavailable result under repository policy |\n| `codex-security:triage-finding` | Frozen sanitized supplied findings, exact source identities, checkout\u002FSHA and private output destination; reuse its GitHub intake reference through authenticated `gh api` before freeze | One static verdict per source ID with evidence\u002Fproof gaps; no unrequested advisory intake or secret persistence |\n| `codex-security:validation` | Specific unresolved claims requiring bounded validation, original IDs\u002Fevidence, isolated fixtures and private artifact destination | Evidence-backed result per claim or explicit remaining uncertainty; never treat setup failure as disproof |\n| `playwright-cli` or available Playwright\u002Fbrowser skill | Exact source\u002Frepository, collect or approved disposition action, campaign auth contract and private destinations | Verified account\u002Ffilter, complete export or source readback; login budget and credential isolation preserved |\n| `procedural-development` | Grouped actionable\u002Funcertain inventory, full S0 ledger, current verified runtime root, same logical run ID and recovery record, spent rounds, resolved roles, private tracker, `FOLLOWUP_CHANNEL=private-record`, source-resolution and LCM integration contracts | Invoke only after complete triage barrier; accept delivery only against caller audit |\n| `codex-security:fix-finding` | From procedural-development's assigned Daybreak implementer: approved group plan, constituent claims, isolated worktree, acceptance and evidence | Complete fix\u002Fno-change\u002Fblocked evidence; return to existing owner\u002Freview lifecycle, no second coordinator |\n| `codex-security:verify-fix` | Only when the user explicitly requests security-fix verification: findings and exact candidate checkout | Read-only per-finding fixed\u002Fstill-vulnerable\u002Finconclusive result; otherwise use the existing fix\u002Freview verification |\n| `flock` | Only when shared LCM integration requires it: declared resource, authorized coordinator and protected operation | Existing skill's live ownership through verification; no invented campaign locks |\n\nUse the existing skill's output contract, linking its private result from the ledger\ninstead of rewriting reports. A delegated skill's narrower boundaries remain in\nforce. Where it cannot meet this campaign's transport, privacy or model contract,\nreport the specific incompatibility and continue independent work only.\n\n## Phase handoff\n\nFreeze complete S0, triage every member, and finish centralized cross-source\ngrouping before any implementation. Evidence-backed dismissals may happen during\ntriage, after freeze and fresh source readback. Pass only actionable\u002Funcertain\ngroups to `procedural-development`, keeping the full denominator privately.\nThe caller retains source dispositions and final audit; the invoked skill owns\nremediation execution. Neither an empty queue nor a merged PR proves completion.\n","# Triage security issues\n\n## Contract and mandatory reuse\n\nExecution covers inventory, complete triage\u002Fgrouping, then remediation through\nverified source resolution, subject to narrower user limits. Authoring, reviewing,\nor testing this skill never starts a campaign or authorizes live alert mutations.\n\n**Invoke existing skills that implement the needed capability. Do not duplicate\ntheir natural-language procedures or copy their scripts.** This rule applies to\nauthors and executing agents. This wrapper owns only security-source acquisition,\nidentity, private accounting, cross-source grouping and source-resolution policy.\nInspect available skills\u002Fhelpers before adding code for a demonstrated gap; do not\nbuild another GitHub client, browser-session manager, campaign engine or delivery\nscript. Do not invoke `triage-fix-all-bugs`: its native Bug input contract differs.\n\nRead repository\u002Flocal instructions and [LCM integration](..\u002Fshared\u002Flcm-development.md).\nInvoke `lcm-memory` for required project context without storing raw findings or\ncredentials. Read [procedural-development](..\u002Fprocedural-development\u002FSKILL.md) and\nits coordination\u002Fdelivery references. Apply its\n[root lifecycle admission](..\u002Fprocedural-development\u002Freferences\u002Froot-lifecycle.md)\nbefore triage dispatch or unattended waiting. Every worker receives the\n[worker execution brief](..\u002Fprocedural-development\u002Freferences\u002Fworker-execution.md)\nand must supply its command completion\u002Fcleanup evidence.\n\nRead [sources](references\u002Fsources.md), [authentication](references\u002Fauthentication.md),\n[triage](references\u002Ftriage.md) and [accounting](references\u002Fcoordination.md) before\ncollection. These references supply caller policy, not replacement workflows.\nBefore collection or campaign dispatch, verify `gh auth status --hostname \u003Chost>`.\nIf unauthenticated, ask the user to run `gh auth login --hostname \u003Chost>` and wait\nbefore continuing. Recheck after they authenticate; do not open a GitHub browser\nlogin or acquire another credential source.\n\n## Configuration\n\nInvocation instructions, not CLI flags: `REPOSITORY` defaults to the checkout's\ncanonical GitHub host\u002Fowner\u002Frepository; `CODEX_CSV` optionally supplies a snapshot;\n`RESUME_RUN` selects an existing private campaign. A repository override must map\nto the inspected checkout before assessment. Default sources are the four in the\ndescription; never silently add Issues, advisories\u002Fprivate reports or new scans.\n\nCopy of the Alpha roster with mandatory security bindings:\n\n| ROLE | Model default | Reasoning default | Tier default |\n| --- | --- | --- | --- |\n| `TRIAGE` | `gpt-daybreak-blue-latest` | high | default |\n| `OWNER` | `gpt-5.6-sol` | medium | default |\n| `IMPLEMENTER` | `gpt-daybreak-blue-latest` | high | default |\n| `SECURITY_IMPLEMENTER` | `gpt-daybreak-blue-latest` | high | default |\n| `ESCALATED_IMPLEMENTER` | `gpt-daybreak-blue-latest` | high | default |\n| `REVIEWER_A` | `cortex-hq\u002Fzai-org-GLM-5.3` | maximum supported | default |\n| `REVIEWER_B` | `xai\u002Fgrok-4.6` | medium | default |\n| `SYNTHESIS_REVIEWER` | `anthropic\u002Fclaude-opus-5` | medium | default |\n\nResolve `\u003CROLE>_MODEL`, `\u003CROLE>_REASONING`, `\u003CROLE>_TIER` using shared precedence and\nroute preflight. Owner\u002Freviewer models are configurable. `TRIAGE`, `IMPLEMENTER`,\n`SECURITY_IMPLEMENTER` and `ESCALATED_IMPLEMENTER` must remain Daybreak Blue,\nincluding duplicate adjudication, validation and nested implementation calls.\nAn incompatible model override is a configuration conflict, not a fallback.\nInherit shared owner limits, candidate budgets and best-effort tier rules; do not\nredefine them. Record resolved values and pass them unchanged on resume\u002Fhandoff.\n\n## Skill invocation boundaries\n\nDiscover installed skills by these names and read their entrypoints before invoking\nthem. Missing required skills block that capability; do not recreate their workflow\ninline. External plugin paths are resolved from the active skill catalog, never\nhard-coded to this author's machine. The parent campaign owns dispatch and grouping;\n`triage-finding` runs inline inside its assigned Daybreak worker without nested\ntriage dispatch, dynamic tests, deduplication or source mutation.\n\n| Invoke | Input | Required evidence \u002F condition for continuing |\n| --- | --- | --- |\n| `lcm-memory` | Target project and bounded context question | Applicable context or recorded empty\u002Funavailable result under repository policy |\n| `codex-security:triage-finding` | Frozen sanitized supplied findings, exact source identities, checkout\u002FSHA and private output destination; reuse its GitHub intake reference through authenticated `gh api` before freeze | One static verdict per source ID with evidence\u002Fproof gaps; no unrequested advisory intake or secret persistence |\n| `codex-security:validation` | Specific unresolved claims requiring bounded validation, original IDs\u002Fevidence, isolated fixtures and private artifact destination | Evidence-backed result per claim or explicit remaining uncertainty; never treat setup failure as disproof |\n| `playwright-cli` or available Playwright\u002Fbrowser skill | Exact source\u002Frepository, collect or approved disposition action, campaign auth contract and private destinations | Verified account\u002Ffilter, complete export or source readback; login budget and credential isolation preserved |\n| `procedural-development` | Grouped actionable\u002Funcertain inventory, full S0 ledger, current verified runtime root, same logical run ID and recovery record, spent rounds, resolved roles, private tracker, `FOLLOWUP_CHANNEL=private-record`, source-resolution and LCM integration contracts | Invoke only after complete triage barrier; accept delivery only against caller audit |\n| `codex-security:fix-finding` | From procedural-development's assigned Daybreak implementer: approved group plan, constituent claims, isolated worktree, acceptance and evidence | Complete fix\u002Fno-change\u002Fblocked evidence; return to existing owner\u002Freview lifecycle, no second coordinator |\n| `codex-security:verify-fix` | Only when the user explicitly requests security-fix verification: findings and exact candidate checkout | Read-only per-finding fixed\u002Fstill-vulnerable\u002Finconclusive result; otherwise use the existing fix\u002Freview verification |\n| `flock` | Only when shared LCM integration requires it: declared resource, authorized coordinator and protected operation | Existing skill's live ownership through verification; no invented campaign locks |\n\nUse the existing skill's output contract, linking its private result from the ledger\ninstead of rewriting reports. A delegated skill's narrower boundaries remain in\nforce. Where it cannot meet this campaign's transport, privacy or model contract,\nreport the specific incompatibility and continue independent work only.\n\n## Phase handoff\n\nFreeze complete S0, triage every member, and finish centralized cross-source\ngrouping before any implementation. Evidence-backed dismissals may happen during\ntriage, after freeze and fresh source readback. Pass only actionable\u002Funcertain\ngroups to `procedural-development`, keeping the full denominator privately.\nThe caller retains source dispositions and final audit; the invoked skill owns\nremediation execution. Neither an empty queue nor a merged PR proves completion.\n",{"name":5,"description":7},"main","f436832f32da25160decef3252a945e0856fccf9",".agents\u002Fskills\u002Ftriage-security-issues",2,"https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm","https:\u002F\u002Fgithub.com\u002Fdonadiosolutions","https:\u002F\u002Fbcdonadio.com","2026-11-15 01:35:40",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add donadiosolutions\u002Flcm --skill triage-security-issues",{"tool":58,"command":59},"bunx","bunx skills add donadiosolutions\u002Flcm --skill triage-security-issues",{"tool":61,"command":62},"pnpm","pnpm dlx skills add donadiosolutions\u002Flcm --skill triage-security-issues","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftriage-security-issues\u002FSKILL.md",true,[66,72,76,80],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"references\u002Fauthentication.md","REFERENCE","参考文档",3932,"https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftriage-security-issues\u002Freferences\u002Fauthentication.md",{"path":73,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fcoordination.md",4160,"https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftriage-security-issues\u002Freferences\u002Fcoordination.md",{"path":77,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fsources.md",9779,"https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftriage-security-issues\u002Freferences\u002Fsources.md",{"path":81,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Ftriage.md",4344,"https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftriage-security-issues\u002Freferences\u002Ftriage.md",[85,102,119,135,149],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":39},"01M71KW14J9KP5VS0XEEW1YFKM","triage-fix-all-bugs","Use when asked to coordinate triage and remediation of all currently open native GitHub Bug issues in this repository. Not for a single issue or merely authoring or reviewing skills.","https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftriage-fix-all-bugs\u002FSKILL.md",[],[92,93,19,94,32,95,96,97,98,23,99,25,30,100,101,22,37,38],"bugs","fix","triage fix all bugs","issue","authoring","bug","repository","native","single","open",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":39},"01M71KVWVSNMYKBZWHS0DTP2XN","procedural-development","Use when executing or resuming a specified issue or bounded development inventory in a GitHub repository. Not for repository-wide Bug discovery, Epic assessment, or merely authoring or reviewing skills.","https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fprocedural-development\u002FSKILL.md",[],[109,110,111,112,113,97,98,25,114,115,30,32,116,96,117,95,118,37],"procedural development","procedural","development","EPIC","wide","resuming","inventory","assessment","bounded","discovery",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":39},"01M71KVSTRE9KPDFCS874G606W","lcm-release","Use when explicitly asked to cut or recover a manual LCM release. Not for ordinary version bumps or Changesets release-note\u002Fversion PR work.","https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Flcm-release\u002FSKILL.md",[],[126,127,128,129,130,131,37,132,133,32,30,134],"release","lcm release","version","work","changesets","pr","cut","manual","note",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":39},"01M71KVPKACRW3S0EDSQEN699C","implement-epic","Use when asked to execute or resume an existing planned native GitHub Epic and its required deliverables in this repository. Not for inventing a roadmap, triaging all Bugs, or merely authoring or reviewing skills.","https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fimplement-epic\u002FSKILL.md",[],[112,142,143,144,92,37,32,145,146,30,147,25,99,98,96,148],"implement","implement epic","deliverables","Existing","roadmap","resume","execute",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":39},"01M71KVMFBVCGBV5W00Z7NZV4Z","flock","Use when cooperating workers need exclusive ownership of a named resource on the same Linux host through an advisory flock mutex.","https:\u002F\u002Fgithub.com\u002Fdonadiosolutions\u002Flcm\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fflock\u002FSKILL.md",[],[151,156,157,158,32,159,30,160,161],"linux","mutex","host","workers","ownership","advisory"]