Skip to content
Get packs

Handle Security Advisory Response

Walks an agent through coordinating a confidential GitHub security advisory fix and publishing it.

Source Download skill
Repository
paperclipai/paperclip
Stars
110,078
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a step-by-step playbook for handling a privately reported security vulnerability in the Paperclip project. It tells the agent to fetch the advisory details through the GitHub CLI, create a temporary private fork, develop and test a minimal fix locally, request a CVE, and then publish the advisory and a security release together. It also repeatedly warns the agent to keep all details confidential and to pause for a human at the points where posting to the reporter is needed.

Great for

  • Maintainers of the Paperclip project who need to respond to a GitHub Security Advisory
  • Security responders who want a consistent checklist for private-fork fixes and coordinated disclosure

Skip it if

  • Anyone outside the Paperclip maintainer team, since it hardcodes the paperclipai/paperclip repository, private fork workflow and release process and is not a general vulnerability guide (it is specific to one project's setup)
  • Situations where the release should be staggered or reviewed slowly, because the skill insists on publishing everything at once, which may skip review steps and could be risky if the fix is incomplete

Try asking

  • “Handle the GitHub security advisory GHSA-x8hx-rhr2-9rf7 reported by a user, starting by fetching its details”
  • “Set up a private fork and security-fix branch to develop a patch for an advisory”
  • “Prepare the CVE request and the publish-and-release steps for a finished security fix”
Step-by-step guide: how to use Handle Security Advisory ResponseInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    deal-with-security-advisory.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip deal-with-security-advisory.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip deal-with-security-advisory.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Fill in the placeholders (ghsaId, reporterHandle, severity, timeframe, patchedVersion) before running, and have a human review the publish step before it runs.
  • Run the local tests yourself because CI does not run on the private fork, and check that the fix closes the reported attack vector and adjacent ones.
  • Keep all commit messages, branch names and comments generic until publication, as the skill requires.

What's inside

  • SKILL.md

Redistributed unmodified from paperclipai/paperclip under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.