draft-security-advisory — Claude Code skill: how to install
Transforms vulnerability reports into publication-ready GitHub Security Advisories without leaking payloads, endpoints, or file paths.
npx skills add frappe/skills --skill draft-security-advisory -a claude-codeWhat draft-security-advisory does
The skill drafts content for GitHub Security Advisory (GHSA) submissions by focusing strictly on vulnerability classes. It deliberately strips out exact function names, file paths, endpoints, and reproduction payloads. Phrasing stays intentionally generic, referring only to umbrella areas like "certain endpoints" or "portal pages" so outsiders cannot reverse-engineer the unpatched flaw from the advisory text.
It structures output across four core advisory text fields: Summary, Details, Proof of concept, and Impact. Each field handles a distinct part of the explanation. Repetition is avoided. Below the text fields, the skill compiles structured advisory metadata, calculating the CVSS v3.1 vector and score while assigning the appropriate CWE identifier.
Direct model invocation is disabled (disable-model-invocation: true), meaning you trigger the skill deliberately with your report text. If the report omits supported branches, you will need to supply which release streams are currently maintained before populating the affected products table.
What it helps with
- Convert raw vulnerability reports into publication-ready GitHub Security Advisories
- Redact filenames, endpoints, and exploit payloads from public advisory text
- Calculate CVSS v3.1 scores and vectors with metric-level rationales
- Assign the appropriate CWE identifier based on the vulnerability class
Example prompts for the agent
- Draft a GitHub Security Advisory from this vulnerability report
- Generate GHSA text and CVSS v3.1 metrics for this report, omitting file paths
- Prepare a security advisory draft based on this report, setting the workaround to upgrade required
How to install draft-security-advisory
1Skills CLI (Vercel)
npx skills add frappe/skills --skill draft-security-advisory -a claude-code2Manually: put the files in place
~/.claude/skills/draft-security-advisory/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/draft-security-advisory/
1Skills CLI (Vercel)
npx skills add frappe/skills --skill draft-security-advisory -a codex2Manually: put the files in place
.agents/skills/draft-security-advisory/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add frappe/skills --skill draft-security-advisory -a cursor2Manually: put the files in place
.cursor/skills/draft-security-advisory/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install frappe/skills draft-security-advisory2Manually: put the files in place
.github/skills/draft-security-advisory/SKILL.md1Skills CLI (Vercel)
npx skills add frappe/skills --skill draft-security-advisory -a gemini-cli2Platform CLI
gemini skills install https://github.com/frappe/skills --path skills/draft-security-advisoryManually: put the files in place
.devin/skills/draft-security-advisory/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add frappe/skills --skill draft-security-advisory -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about draft-security-advisory
How to install draft-security-advisory in Claude Code?
Run npx skills add frappe/skills --skill draft-security-advisory -a claude-code in your terminal.
What does draft-security-advisory do?
It formats vulnerability disclosures into the four standard GitHub Security Advisory text fields and calculates CVSS v3.1 metrics and CWE mappings.
Why does the skill omit specific code snippets and payloads?
The advisory focuses on vulnerability classes rather than instances so readers cannot deduce the exact patched code path before systems are upgraded.
