Security & Auditing Skills

Walk a security team member through allocating a CVE for an tracking issue.

For a batch of findings from a non-security audit tool ( — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer / equivalent; full list in the body) against , draft the smallest fix for each finding. Re-runs the tool after each batch to confirm the findings are cleared. Produces a commit and a hand-back artefact; never opens a PR on autopilot or merges.

Post-vote committer and PMC onboarding for Apache projects. Walks the nominator through every step from ICLA check to welcome announcement for both incubating podlings and graduated top-level projects.

Read-only GitHub activity card for a named contributor on . Fetches PR authorship, code-review activity, issues, and PR/issue comments over a configurable window. Limited to GitHub-visible activity — the body documents the off-GitHub tracks the nominator must supply separately. No readiness verdict is produced; use contributor-nomination for a full nomination brief.

Read-only nomination brief for a named GitHub contributor on . Aggregates GitHub activity across all contribution tracks plus maintainer-supplied off-GitHub signal, and flags vendor-neutrality context — the evidence a PMC needs to open a committer or PMC nomination thread.

Generate a CVE 5.x JSON document from an tracking issue, ready to paste into the Vulnogram source tab of the ASF CVE tool at https://cveprocess.apache.org/cve5/ source. The conversion is deterministic: same issue in, same JSON bytes out. Handles multiple credits (one per line) and multiple references (URLs extracted from the issue's "Public advisory URL" and "PR with the fix" fields; the "Security mailing list thread" field is treated as internal-only and never exported).

Draft a single net-new good first issue on the configured repo from one supplied candidate such as a known gap or a small maintainer-named task. The skill first runs a suitability gate to confirm the candidate is small and newcomer-safe. If it passes the skill drafts one issue. The draft carries scope, code pointers, contributing-doc links, acceptance criteria, and an effort estimate. A readiness checklist gates the draft before it is shown. Nothing is filed via gh until the maintainer explicitly confirms. The skill never curates or relabels the existing backlog.

For a single triaged issue confirmed as a bug or feature, draft a fix against on . Produces the failing test, the smallest production change, the targeted+module test runs, and the commit. The PR is NOT opened on autopilot; the human committer reviews, signs, and pushes. Hand-back artefact summarises branch, commits, test results, and scope.

Sweep a configured pool of resolved or end-of-life issues and re-assess each against the current . Per-issue: invoke issue-reproducer to extract and run the reporter's code, classify the runtime outcome, attach a nature analysis, compose a verdict.json. Hand-back-on-completion contract: no comments posted, no transitions, no closures.

Read-only dashboard over a directory of verdict.json files produced by issue-reassess campaigns. Surfaces a health rating, classification distribution, partial-fix surfaces, oldest-unresolved buckets, and per-component breakdowns. Output is HTML by default; markdown fallback available. Read-only on tracker state; consumes campaign artefacts.

For a single issue identifying a code-level bug, extract the reporter's example code from the issue body, adapt it to run on the current , execute via , and compose a verdict.json describing the observed behaviour vs the expected failure. Read-only on the tracker — produces evidence, never posts. Invoked by issue-triage and issue-reassess; can also be run standalone.

Print a human-readable index of every skill in this repository, grouped by family prefix (pr-management, security, setup, ...) with each skill's name and the first…

Print a human-readable index of every skill in this repository, grouped by family prefix (pr-management, security, setup, ...) with each skill's name and the first…

Read-only audit of GitHub Actions workflow runner compatibility for one repository, an explicit repository set, one Apache project with multiple repositories, or the full Apache GitHub org. Finds obsolete GitHub-hosted runner labels and macOS runner/tool architecture mismatches. Produces TSV evidence files; never edits workflows, opens PRs, or posts comments.

Sweep open issues for inactivity past a configurable threshold and propose either a closure (when the issue has been unresponsive long enough to presume abandonment) or an update request (nudge the reporter to confirm the issue is still relevant). Waits for maintainer confirmation before posting any comment or closing anything.

Draft a first-contact orientation comment for a first-time contributor on a newly opened issue or PR on the configured repo. Detects first-time authorship via the GitHub authorassociation field and drafts a welcome with contributing-guide link, community-norm pointers, and expected next steps. Waits for explicit maintainer confirmation before posting. Does not post for repeat contributors.

Draft the [ANNOUNCE] email body and open (not merge) the site-bump PR for a promoted release of . Reads release metadata from the planning issue and /release-management-config.md; produces a ready-to-copy [ANNOUNCE] subject + body and proposes the site-bump PR. Never sends mail and never merges the PR without explicit RM confirmation.

Triage a security scanner's multi-finding output (read via a pluggable scan-format adapter) and turn findings into security work only after a complete operator-reviewed triage. Reads the scan's finding index plus its per-finding evidence; buckets each finding by disposition; applies only the operator's confirmed per-entry decisions. Publishes the report as a gist and can open a report-back PR.

Show how the apache-magpie framework is adopted in the current repo, then adjust that setup in place. Renders a Markdown adoption dashboard: install method and pin, drift, the wired agent targets, the installed skill families, and symlink health. From the same view the user can add or drop agent targets and skill families; the actual change runs through the setup skill.

Fan a local diff through three independent, axis-focused review passes (correctness, security, conventions), then merge the findings into a single structured report. Each pass is isolated so findings from one axis cannot suppress or bias the others. The merged report uses the same format as pairing-self-review so the developer gets a consistent signal regardless of which Pairing skill they invoke.

Run a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and the upstream default branch), checks correctness, security, and project conventions, and returns a structured report to the developer. No state changes, no PR, no external writes — the report is the output.

Draft a teaching-register comment on a single GitHub issue or PR thread on the configured repo (default: read from /project.md → upstreamrepo), aimed at a contributor who is missing repo context the maintainer would otherwise have to spell out. The skill reads the thread, decides whether a mentoring intervention is warranted, drafts one comment per the project's tone guide and convention pointers, runs the tone checklist, then waits for explicit maintainer confirmation before posting via gh. Does not triage (no labels, draft toggles, closes), review code (no diff comments, approve / request-changes), or open PRs — those are Triage and Drafting surfaces. Bows out and pings the configured maintainer team when the thread reaches maxagentturns, when the contributor pushes back on a substantive design point, when the topic enters outofscopetopics, or when the contributor explicitly asks for a human.

Identify trivial, low-risk pull requests in the ready for maintainer review queue of that pass every quality gate and touch only supplementary areas (docs, changelog, translations, tests) — the "express lane" a maintainer can review and merge in seconds. Surfaces and ranks candidates with per-PR diff summaries, an all-gates-green attestation, and the exact merge command. On the maintainer's explicit per-PR confirmation it can submit an APPROVE review (the maintainer's own review of the trivial diff — useful when the PR has no approvals yet and branch protection needs one), exactly as pr-management-code-review does. It never merges itself — automated merge is the framework's deliberately-deferred Mode D; the maintainer runs the printed merge command in their own session.

Produce maintainer-facing statistics about open pull requests on the configured repo (default: read from /project.md → upstreamrepo). Successor to breeze pr stats: read-only, no mutations — just two summary tables grouped by area: label (Triaged final-state, and Triaged still-open) plus per-area age-bucket breakdowns so the maintainer can see where queue pressure is sitting.