Guide · Agent skill
How to use the Handle Security Advisory Response agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the deal-with-security-advisory agent skill does, how to install it for Claude, and how to ask an agent to use it. It is written for maintainers of the Paperclip project who need to respond to a GitHub Security Advisory. By the end you will know what the skill covers, what it requires, and where it asks for a human to act.
Handle Security Advisory Responsepaperclipai/paperclip · MIT Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. Alternatively, upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
- 2Check the prerequisites. Confirm that gh is installed and authenticated with access to the Paperclip security advisories, and that git and pnpm are available.
- 3Gather the advisory details. Have the advisory ID, reporter handle, severity and notes ready, since the skill's templates use them.
- 4Ask for the advisory work. Describe the task in plain language and include the advisory ID so the agent loads the skill.
- 5Complete the human steps. Post the acknowledgement and fix-ready messages on the advisory thread yourself, because the agent cannot do that.
- 6Review the fix before publishing. Check the diff, local test results and the adjacent-vector review before allowing the publish steps to run.
- 7Verify publication. After publishing, confirm the advisory state, CVE and release, and post the final confirmation on the thread.
What the skill makes the agent do
The skill is a step-by-step playbook, contained in a single file named SKILL.md, for handling a privately reported vulnerability in the paperclipai/paperclip repository. It tells the agent to fetch the advisory details through the GitHub CLI, create a temporary private fork, develop and test a minimal fix locally, request a CVE, and then publish the advisory and a security release together.
The skill also repeatedly tells the agent to keep all details confidential, including in commit messages, PR titles, branch names and comments. It pauses for a human operator at the points where a message needs to be posted to the reporter.
- Fetch the advisory with gh api
- Acknowledge the report (human step)
- Create a temporary private fork and work on a branch named security-fix
- Develop and test the fix locally, since CI does not run on the private fork
- Coordinate with the reporter (human step)
- Request a CVE
- Publish the advisory and cut a security release together
- Verify publication and the CVE afterwards
Install the skill in Claude
Download the ZIP file for the skill from this page. To install it for your user account, unzip it into ~/.claude/skills/. To install it for a single project, unzip it into that project's .claude/skills/ folder. The skill's files, including SKILL.md, should end up inside a folder named deal-with-security-advisory.
You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Trigger the skill with a natural request
The skill's description says it should be used when coordinating advisory triage, private-fork fixes, CVE and publication steps, and immediate security releases. Ask for that work in plain language and reference the advisory ID. The skill's template expects the advisory ID (for example GHSA-x8hx-rhr2-9rf7), the reporter's GitHub handle, the severity and any notes.
Because the skill uses placeholders such as the advisory ID, reporter handle, timeframe and patched version, have those values ready before you start.
- Example request: Handle the security advisory GHSA-x8hx-rhr2-9rf7 reported by a GitHub user, severity high, using the deal-with-security-advisory skill.
- Example request: Walk me through the private fork fix for this advisory and tell me which steps need a human.
- Example request: Check the post-publication status of the advisory and the v-release.
What the skill needs before it runs
The skill expects the GitHub CLI (gh) to be installed and authenticated with credentials that can access the Paperclip repository's security advisories. It also needs git and pnpm for cloning and local testing, plus access to the Paperclip repository and its releases. The skill states that the agent has access to credentials outside its sandbox.
- GitHub CLI (gh), authenticated with access to the repository's security advisories
- git
- pnpm, for local testing
- Access to the paperclipai/paperclip repository and its releases
Safety notes: scripts and network access
This skill runs scripts and uses the network. Its steps call the GitHub API through gh api, push to a private fork, and create a public GitHub release. Review each command before the agent runs it, and confirm that the advisory is the one you intend to publish.
The skill publishes everything at once. It does not offer a staggered or slow review option, so do not use it where the release must be reviewed slowly. If the fix might be incomplete, pause before step 6.
- Commands call the GitHub API and publish a public release
- Pushes go only to the temporary private fork in the template
- Publication is intended to happen all at once
- Human steps are marked in the skill and must be done by an operator
Tips for using the skill well
The skill asks for a minimal, focused fix with no unrelated changes. It also asks the agent to consider adjacent attack vectors and to avoid new dependencies unless they are absolutely necessary. Keep these points in mind when you review the agent's diff.
Do not commit pnpm-lock.yaml, because the repository has actions that manage it. Expect that CVE propagation can take a few hours, so an unassigned CVE right after publication is normal.
- Reproduce the vulnerability first, then confirm the patch prevents it
- Check the whole codebase for the same class of problem
- Do not commit pnpm-lock.yaml
- Use a generic branch name such as security-fix
gh api repos/paperclipai/paperclip/security-advisories/{{ghsaId}}What people use it for
- A Paperclip maintainer fetches a newly reported advisory and gets a consistent checklist to follow.
- A security responder prepares a private-fork fix and reviews it locally before publication.
- A maintainer drafts the security release notes with credit to the reporter.
- A team checks whether the CVE and release were published after a security patch.
Frequently asked questions
How do I install the deal-with-security-advisory skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for your user account, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What do I need to run this skill?
You need the GitHub CLI (gh) authenticated with credentials that can access the Paperclip repository's security advisories, plus git and pnpm. You also need access to the paperclipai/paperclip repository and its releases.
Is the deal-with-security-advisory skill free?
The source material for this page does not state pricing or licence terms beyond the listed licence, which is MIT. Check the repository's licence file for the terms that apply.
Can I use this skill for a project other than Paperclip?
Not as written. The skill hardcodes the paperclipai/paperclip repository, its private fork workflow and its release process, so it is specific to that project's setup.
Why does the skill say CI will not run on the private fork?
The skill states this is a GitHub limitation by design, so the agent must run tests locally. It asks for local testing before any fix is pushed.
Why do I need to post comments myself?
The skill says the advisory thread has no comment API, so steps that require posting to the reporter are marked as human steps. The agent provides templates, and a human operator posts them.
What are the alternatives if this skill is not a fit?
The source does not name alternatives. For a staggered or more heavily reviewed release, follow your own project's disclosure process rather than this skill, which publishes everything at once.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits Paperclip maintainers and security responders who want a consistent checklist for private-fork fixes and coordinated disclosure. It is a poor fit for anyone outside that project's setup, or for releases that need to be staggered or reviewed slowly, because it publishes everything at once.
Download the skill