Security Disclosure Track

Name: Security Disclosure Track
Author: jmagly

ASecurity

Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure

207 stars
0 votes
0 copies
3 views
Added May 27, 2026

data-aigobashnodegitsecurity

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned May 27, 2026

npx -y skills add jmagly/aiwg --skill security-disclosure-track --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Security Disclosure Track?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Security Disclosure Track

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/jmagly-security-disclosure-track/badge)](https://www.skillsdirectory.com/skills/jmagly-security-disclosure-track)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
namespace: aiwg
name: security-disclosure-track
platforms: [all]
description: Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure
requires:
  - case-record: .aiwg/security-engineering/reviews/disclosures/<case-id>.md
  - private-channel: configured advisory, private issue, encrypted email, or encrypted form
ensures:
  - custody-log: every transition records actor, timestamp, evidence, and next deadline
  - disclosure-plan: coordinated-disclosure dates and publication checklist
errors:
  - public-channel: refuses to publish private report details to public tracker channels before disclosure
invariants:
  - embargoed details stay out of public issue threads and commits
  - chain-of-custody record is git-ignored by default
script:
  entrypoint: scripts/track.mjs
  runtime: node
  cwd: project-root
  argsHint: "<case-id> [--stage triage|fix|cve|publish|close] [--evidence <text>] [--decision <text>] [--next-deadline <date>] [--embargo-days N]"
commandHint:
  argumentHint: "<case-id> [--stage triage|fix|cve|publish|close] [--embargo-days N]"
  allowedTools: Read, Write, Bash
  model: sonnet
  category: security
  orchestration: true
---

# Security Disclosure Track

Manage the advisory lifecycle after `security-report` intake. This is the closure-loop companion for private vulnerability disclosure and completes curl Practice 27 coverage.

## Stages

1. **Triage**: validate scope, severity, affected versions, reproduction, reporter contact, and embargo clock.
2. **Fix**: create private implementation plan; avoid public issue leakage; record commits/patches by hash.
3. **CVE**: determine whether CVE assignment is needed; record CNA/contact path.
4. **Publication**: prepare advisory, patched versions, acknowledgements, and release notes.
5. **Close**: confirm disclosure complete, custody record finalized, public advisory linked.

## Custody Record

Records live under `.aiwg/security-engineering/reviews/disclosures/` and are ignored by default. Each transition appends timestamp, actor, evidence, decision, and next deadline.

## References

- `agentic/code/frameworks/security-engineering/skills/security-report/SKILL.md`
- `agentic/code/frameworks/security-engineering/templates/SECURITY.md`