Agent skill · security · paperclipai
deal-with-security-advisory
Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security releases.
Why this skill is useful
Provides detailed procedures for handling security advisories and private fork management that the AI wouldn't reliably generate on its own.
What it needs
Requires github account access. About 5k tokens when loaded. Last updated 2026-08-07. 75,771 stars on the source repository.
What this skill does
Security Vulnerability Response Instructions ⚠️ CRITICAL: This is a security vulnerability. Everything about this process is confidential until the advisory is published. Do not mention the vulnerability details in any public commit message, PR title, branch name, or comment. Do not push anything to a public branch. Do not discuss specifics in any public channel. Assume anything on the public repo is visible to attackers who will exploit the window between disclosure and user upgrades. Context A security vulnerability has been reported via GitHub Security Advisory: Advisory: {{ghsaId}} (e.g. GHSA-x8hx-rhr2-9rf7) Reporter: {{reporterHandle}} Severity: {{severity}} Notes: {{notes}} Step 0: Fetch the Advisory Details Pull the full advisory so you understand the vulnerability before doing anything else: Read the description, severity, cvss, and vulnerabilities fields. Understand the attack vector before writing code. Step 1: Acknowledge the Report ⚠️ This step requires a human. The advisory thread does not have a comment API. Ask the human operator to post a comment on the private advisory thread acknowledging the report. Provide them this template: Thanks for the report, @{{reporterHandle}}. We've confirmed the issue and are working on a fix. We're targeting a patch release within {{timeframe}}. We'll keep you updated here. Give your human this template, but still continue Below we use gh tools - you do have access and credentials outside of your sandbox, so use them. Step 2: Create the Temporary Private Fork This is where all fix development happens. Never push to the public repo. This returns a repository object for the private fork. Save the fullname and cloneurl. Clone it and set up your workspace: Do not edit ~/paperclip — the dev server is running off the ~/paperclip master branch and we don't want to touch it. All work happens in the private fork clone. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills paperclipai/deal-with-security-advisory