Security & Auditing Skills

Bootstrap the issue triage configuration for a repository by analyzing existing issues, labels, and contributors to generate .github/issue-triage/config.json and .github/STAKEHOLDERS. Use when setting up triage automation on a new or existing repository for the first time.

Create a product spec from a GitHub issue in this repository by applying the shared write-product-spec workflow with Oz-specific issue context and output paths. Use when an issue should be turned into a product spec artifact stored under specs/GH /product.md and the agent should prepare file changes only, without creating commits or pull requests itself unless a cloud workflow explicitly asks for it.

Detect duplicate GitHub issues by comparing the incoming issue's title and description against the repository issue list. Use during triage to identify 2+ existing issues that are similar and surface them as potential duplicates.

Repo-specific dedupe guidance for oz-for-oss. Only the categories declared overridable by the core dedupe-issue skill may be specialized here.

Repo-specific spec-review guidance for oz-for-oss. Only the categories declared overridable by the core review-spec skill may be specialized here.

Audit a pull request diff for common security concerns (input validation, sanitization, authentication and authorization, secrets management, unsafe dependencies, and related risks) and fold findings into the same review.json produced by the base PR review. Use as a supplement to review-pr whenever a code PR is being reviewed.

Audit a product or tech spec pull request diff for high-level security concerns (threat surface, authentication and authorization model, trust boundaries, sensitive data handling, secrets and key management, dependency posture, and abuse or misuse cases) and fold findings into the same review.json produced by the base spec review. Use as a supplement to review-spec whenever a spec PR is being reviewed.

Repo-specific triage guidance for oz-for-oss. Only the categories declared overridable by the core triage-issue skill may be specialized here.

Update the repo-local dedupe-issue-local companion skill using closed-as-duplicate signals. Use when maintainers repeatedly close issues as duplicates of the same canonical thread and that pattern should feed back into triage duplicate detection.

Update the repo-local review-pr-local and review-spec-local companion skills using human feedback left on pull request conversations. Use when aggregating replies to agent-authored PR review comments, incorporating broader human review comments, extracting repeated reviewer feedback, and refining .agents/skills/review-pr-local/SKILL.md and .agents/skills/review-spec-local/SKILL.md with evidence-backed adjustments.

Update the repo-local triage-issue-local companion skill using signals from recently triaged issues (maintainer re-labels, re-opens, follow-up comments). Use when refining repo-specific triage heuristics and label taxonomy based on how maintainers overrode previous triage output.

Run repository-defined PR verification skills, aggregate the results, and hand back a verification report plus any supporting artifacts without mutating GitHub directly.