# draft-security-advisory

Transforms vulnerability reports into publication-ready GitHub Security Advisories without leaking payloads, endpoints, or file paths.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 480 installs · ★ 158
- Author: frappe
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/frappe/skills/tree/HEAD/skills/draft-security-advisory/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/draft-security-advisory

## What it does

The skill drafts content for GitHub Security Advisory (GHSA) submissions by focusing strictly on vulnerability classes. It deliberately strips out exact function names, file paths, endpoints, and reproduction payloads. Phrasing stays intentionally generic, referring only to umbrella areas like "certain endpoints" or "portal pages" so outsiders cannot reverse-engineer the unpatched flaw from the advisory text.

It structures output across four core advisory text fields: Summary, Details, Proof of concept, and Impact. Each field handles a distinct part of the explanation. Repetition is avoided. Below the text fields, the skill compiles structured advisory metadata, calculating the CVSS v3.1 vector and score while assigning the appropriate CWE identifier.

Direct model invocation is disabled (`disable-model-invocation: true`), meaning you trigger the skill deliberately with your report text. If the report omits supported branches, you will need to supply which release streams are currently maintained before populating the affected products table.

## Requirements
- Works with: GitHub

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add frappe/skills --skill draft-security-advisory -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/draft-security-advisory/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/draft-security-advisory/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add frappe/skills --skill draft-security-advisory -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/draft-security-advisory/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add frappe/skills --skill draft-security-advisory -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/draft-security-advisory/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install frappe/skills draft-security-advisory
```

2. **Manually: put the files in place**
- File: `.github/skills/draft-security-advisory/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add frappe/skills --skill draft-security-advisory -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/frappe/skills --path skills/draft-security-advisory
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/draft-security-advisory/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add frappe/skills --skill draft-security-advisory -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/frappe/skills/tree/HEAD/skills/draft-security-advisory/SKILL.md

## When to use it
- Convert raw vulnerability reports into publication-ready GitHub Security Advisories
- Redact filenames, endpoints, and exploit payloads from public advisory text
- Calculate CVSS v3.1 scores and vectors with metric-level rationales
- Assign the appropriate CWE identifier based on the vulnerability class

## Example prompts
- Draft a GitHub Security Advisory from this vulnerability report
- Generate GHSA text and CVSS v3.1 metrics for this report, omitting file paths
- Prepare a security advisory draft based on this report, setting the workaround to upgrade required

## Similar
- [penetration-testing](https://affpapa.org/en/nevibecode/skills/penetration-testing.md) — skill · 1100 installs
- [vulnerability-scanning](https://affpapa.org/en/nevibecode/skills/devops-skills-vulnerability-scanning.md) — skill · 424 installs
- [security-reviewer](https://affpapa.org/en/nevibecode/skills/security-reviewer.md) — skill · 6000 installs
- [ci-cd-security](https://affpapa.org/en/nevibecode/skills/ci-cd-security.md) — skill · 7900 installs
- [avast-premium-security-awareness](https://affpapa.org/en/nevibecode/skills/avast-premium-security-awareness.md) — skill · 1000 installs
- [triage-finding](https://affpapa.org/en/nevibecode/skills/triage-finding.md) — skill · 30 installs

From the same set: [frappe/skills](https://affpapa.org/en/nevibecode/by/frappe/skills.md) — 5 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md