magpie-security

Plugin magpie-security from marketplace apache-magpie in apache/magpie. Commands read from the repo's manifest — today.

Skills (16)

• cve-allocate

  Walk a governance-authorised member through allocating a CVE for a tracker: allocate it through the `<cve-tool>` API when the tool supports it, else print the allocation link and title and take the allocated ID, then update the tracker (field, label, rollup, CVE JSON) and hand off to `security-issue

• issue-deduplicate

  Merge two <tracker> tracking issues that describe the same root-cause vulnerability, preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector description. Updates the kept issue's body in place, closes the duplicate with the `duplicate` label, and

• issue-fix

  Fix a tracked security issue in a public `<upstream>` PR: sync the tracker, propose a plan, and on confirmation write the change, open the PR from the user's fork (on Subversion: share a private patch and commit once the team clears it), and update the tracker. Public content never reveals the CVE o

• issue-import-from-md

  Open one or more `<tracker>` tracking issues from a markdown file containing a batch of security findings. Each finding becomes one tracker landing in the `Needs triage` board column. The file itself is the full report — there is no inbound reporter to reply to and no PR to inspect. Invoke when a se

• issue-import-from-pr

  Open a tracker for a security-relevant fix that already exists as a public `<upstream>` PR, with no `<security-list>` report. The tracker lands in `Assessed` with scope, PR-state and remediation fields filled from the PR; pairs with `security-cve-allocate`. "import a tracker from PR <N>", "we need a

• issue-import-from-scan

  Triage a security scanner's multi-finding output (via a scan-format adapter; ASVS is the reference), bucket each finding, and apply only the operator's confirmed decisions. Publishes the report as a gist and can open a report-back PR. "import the scan", "triage the <scanner> findings", or given scan

• issue-import-via-forwarder

  Sub-skill for reports relayed onto `<security-list>` by a broker (the ASF security team, a disclosure platform, a SOC) rather than sent by the reporter. Detects the relay, extracts the credit and the reporter-addressing rules through the adapters in `forwarders.enabled`, and hands the routing back.

• issue-import

  Import new `<security-list>` reports into `<tracker>`: find threads not yet tracked, propose the imports (default: import unless rejected), create each tracker in `Needs triage`, and draft a receipt reply to the reporter. First step of the handling process. "import new reports", "check for unimporte

• issue-invalidate

  Close a tracker as invalid: label, closing comment, board archive, and — for `<security-list>` imports — a polite-but-firm reply draft to the reporter with the team's reasoning. No reporter outreach for trackers imported from a public PR. "close NN as invalid", "NN is not a security issue", after th

• issue-sync

  Synchronize a security issue in <tracker> with the state of its GitHub discussion, the <security-list> mailing thread, and any <upstream> PRs that fix it. The skill gathers all relevant signals and proposes label / milestone / assignee / field / draft-email updates — applying only what the user has

• issue-triage

  Classify each `needs triage` tracker as VALID / DEFENSE-IN-DEPTH / INFO-ONLY / INVALID / PROBABLE-DUP / FIX-ALREADY-PUBLIC and, on confirmation, post a triage-proposal comment for the team. Read-only on tracker state. `--retriage` reopens a decided case after new activity. "triage open issues", "pro

• model-prepare

  Produce a first security model for a project that has none: draft it with `<governance-body>` (draft-first, provenance-tagged), then land the model and its `AGENTS.md` → `SECURITY.md` chain as one PR per repository. Proposes; the maintainers decide. "we need a threat model", "write our security mode

• model-update

  Refresh a published security model from the project's decision history (tracker dispositions, advisories, canned responses). Proposes new known-non-finding entries (§1.15) and a model-gap list, regression-checked against past valid reports. Read-only on the tracker. "update our threat model", "add t

• model-verify

  Check a published security model per repository: is it reachable via `AGENTS.md` → `SECURITY.md` at a named commit, and does it cover the minimum-bar sections? Proposes one fix per failing check (a PR for mechanical gaps, mail to `<governance-body>` for substantive ones). "check our security model",

• submit-to-oss-scan

  Prepare the enrolment (or update) PR that puts a project into Anthropic's OSS Scanner: `project.yaml`, an offline-capable `Dockerfile`, and a `threat_model.md` derived from the project's security model; guides the maintainer through testing it first. "submit <project> to the OSS scanner", "enrol us

• tracker-stats-dashboard

  Generate a self-contained HTML dashboard of `<tracker>` repository statistics for security-team review.

Similar plugins