New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Security Advisory Compat Enforcer

by github in github/gh-aw

Review a GitHub security advisory and safely update .github/aw/compat.json with evidence-backed version enforcement.

OfficialMITAuto-check passed

Install Security Advisory Compat Enforcer

skills CLI
$ npx skills add github/gh-aw --skill security-advisory-compat-enforcer -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install github/gh-aw security-advisory-compat-enforcer --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/github/gh-aw.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/security-advisory-compat-enforcer .claude/skills/security-advisory-compat-enforcer && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security-advisory-compat-enforcer
GitHub stars
5.3k
Token cost
~1.5k tokens
SKILL.md length
773 words
Files
1
Skills in repo
52
Repo updated
First seen
Licence
MIT

At a glance

Review a GitHub security advisory and safely update .github/aw/compat.json with evidence-backed version enforcement.

  • Works in 4 steps: Attempt authenticated retrieval first → If authentication is unavailable or… → Record the endpoint and outcome of each… → …
  • SKILL.md covers Required inputs, Evidence retrieval, Choose the correct policy field and Write remediation guidance, plus 3 more sections
  • Calls gh

What it does

Security Advisory Compat Enforcer is an agent skill from github/gh-aw, published by the product's own GitHub organization. Review a GitHub security advisory and safely update .github/aw/compat.json with evidence-backed version enforcement.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It works with GitHub. The repository describes itself as: GitHub Agentic Workflows. The licence is MIT.

Example prompts

  • “/security-advisory-compat-enforcer”

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Attempt authenticated retrieval first
  2. If authentication is unavailable or access fails, try the public global
  3. Record the endpoint and outcome of each attempt. If both sources are
  4. Verify the proposed patched version independently. Prefer a published

What it can do on your machine

Read from SKILL.md and the folder at commit eb63040. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gh

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use gh, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Advisory Compat Enforcer loads about 1.5k tokens when it runs. Until then it costs about 38 tokens; SKILL.md has 773 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~38
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from github/gh-aw at commit eb63040, republished under its MIT licence (© github). 773 words, ~1,542 tokens.

Download SKILL.mdSave it as .claude/skills/security-advisory-compat-enforcer/SKILL.md (or your agent's skills folder).
name
security-advisory-compat-enforcer
description
Review a GitHub security advisory and safely update .github/aw/compat.json with evidence-backed version enforcement.

Security Advisory Compatibility Enforcer

Use this skill to translate a GitHub repository security advisory into the smallest safe update to .github/aw/compat.json.

Required inputs

Record the repository, GHSA identifier, requested enforcement policy, and any patched version supplied by the user. Treat a user-supplied version as a target to verify, not as evidence for advisory details.

Evidence retrieval

  1. Attempt authenticated retrieval first: gh api repos/OWNER/REPO/security-advisories/GHSA-ID.
  2. If authentication is unavailable or access fails, try the public global advisory endpoint: gh api advisories/GHSA-ID (or its equivalent REST URL).
  3. Record the endpoint and outcome of each attempt. If both sources are inaccessible, state that explicitly. Never infer or invent the affected package, vulnerable range, severity, CVE, publication state, or patched version.
  4. Verify the proposed patched version independently. Prefer a published repository release or tag, then package-registry metadata when applicable. Cite the exact URL or command result. Do not update compatibility policy if the target cannot be verified, unless the user explicitly directs use of a supplied target despite inaccessible advisory metadata; document that limitation without converting it into fabricated advisory evidence.

Choose the correct policy field

  • minimumVersion is a hard floor: activation fails for every compiler version below it. Change it only when the requested remediation is a universal minimum-version enforcement.
  • blockedVersions rejects listed versions exactly. Change it only when evidence or explicit instructions identify exact versions to deny and a continuous minimum floor would be inaccurate.
  • minRecommendedVersion only warns below the value. Change it only for an explicitly requested recommendation, never as a substitute for enforcement.
  • Agent rows under agent-compat-v1 select compatible agent versions; they are unrelated to compiler security enforcement unless separate evidence requires an agent compatibility change.

Write remediation guidance

Provide concise, actionable remediation in .github/aw/compat.md and the final report. Follow established security-advisory terminology:

  1. Identify the affected product or component, GHSA identifier, CVE identifier when assigned, affected versions, and first fixed or unaffected version. Use exact bounded ranges and do not broaden the advisory's claims.
  2. State the permanent remediation in imperative language. Give exact, copyable upgrade and regeneration commands verified against official documentation. For compiler advisories, explain whether existing generated workflows must be recompiled and redeployed; blocking a vulnerable version prevents execution but does not repair generated artifacts.
  3. Separate remediation from mitigations and workarounds. Include a temporary measure only when the advisory documents it. If the retrieved advisory does not identify one, say so without claiming that no workaround exists.
  4. Include a verification step that checks the installed version and any regenerated artifacts. Do not treat a successful install alone as proof that deployed workflows were remediated.
  5. Link the advisory, fixed release, and authoritative upgrade documentation. Mention severity, CVSS, known exploitation, CISA KEV status, deadlines, or urgency only when verified from authoritative evidence.

Do not invent commands, CVE identifiers, affected configurations, mitigations, or timelines. If remediation details cannot be verified, identify the missing evidence and leave the instructions explicitly incomplete.

Show full SKILL.md (286 more words)Show less

Safe edit procedure

  1. Parse the current JSON and record all four policy areas above.
  2. Compare semantic versions numerically. A minimum is monotonic: never lower a non-empty minimumVersion or minRecommendedVersion. Stop and report a requested downgrade rather than applying it.
  3. Make the narrowest evidence-backed edit. Preserve blockedVersions, minRecommendedVersion, every agent-compat-v1 row, key ordering, and formatting unless the selected policy specifically requires changing them.
  4. When changing blockedVersions, update .github/aw/compat.md in the same change. Account for every blocked version, state why each version or contiguous range is blocked, link to the corresponding advisory, and provide the remediation and verification steps defined above.
  5. Review the final diff and reject unrelated changes.

Required validation

Before reporting completion:

  1. Run the repository's Validate compat.json structure and version formats task from .github/workflows/cgo.yml.
  2. Validate .github/aw/compat.json against .github/aw/compat.schema.json with a JSON Schema Draft 7 validator. JSON parsing or ad hoc field checks are not substitutes for schema validation.
  3. Confirm .github/aw/compat.md accounts for every blockedVersions entry and that each documented range links to its advisory.
  4. Exercise the runtime policy semantics with versions immediately below, at, and above the changed boundary; confirm only the intended hard-fail, warning, or exact-block behavior changed.
  5. Confirm semantic-version monotonicity and byte-for-byte preservation of unrelated policy fields and agent rows.

Do not claim validation that was not run. If repository constraints prohibit a required check, report it as outstanding.

Report

Cite advisory retrieval attempts and patched-version verification. State which field changed, old and new values, why that policy is correct, which fields were preserved, and the compatibility task, schema, documentation, and runtime validation results. Include the remediation, any advisory-supported temporary mitigation, and verification steps. Clearly separate verified facts, user-provided inputs, and unavailable advisory details.

© github, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .github/skills/security-advisory-compat-enforcer of github/gh-aw.

Open the folder on GitHubat commit eb63040

Compare with similar skills

Security Advisory Compat Enforcer next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security Advisory Compat Enforcer compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security Advisory Compat Enforcer this skillgithub/gh-aw5.3k—~1.5kAutomated safety check: PassMIT
PR Babysitteropeninterpreter/openinterpreter69k3 repos~4.2kAutomated safety check: PassApache-2.0
Diagnosing Superpowers Sessionsobra/superpowers296k3 repos~1.7kAutomated safety check: PassMIT
GitHub Deep Researchbytedance/deer-flow83k5 repos~1.3kAutomated safety check: PassMIT
Greplooponyx-dot-app/onyx32k4 repos~3.3kAutomated safety check: PassMIT
Update V8 Versionopeninterpreter/openinterpreter69k2 repos~845Automated safety check: PassApache-2.0

Similar skills

  • PR Babysitter

    openinterpreter/openinterpreter

    Watches an open GitHub pull request until it merges, handling review comments, diagnosing CI failures and retrying flaky checks along the way.

    69k GitHub starsUsed in 3 repos~4.2k tokens
    DevelopmentAuto-check passed

  • Diagnosing Superpowers Sessions

    obra/superpowers

    Investigates a session where Superpowers went wrong, reads the transcripts on disk and produces an evidence-cited report, optionally prepared as a bug report for the maintainers.

    296k GitHub starsUsed in 3 repos~1.7k tokens
    Agent WorkflowsAuto-check passed

  • GitHub Deep Research

    bytedance/deer-flow

    Researches a GitHub repository over four rounds using the GitHub API and web search, then writes a structured markdown report with timeline, metrics and Mermaid diagrams.

    83k GitHub starsUsed in 5 repos~1.3k tokens
    Research & ScienceAuto-check passed

  • Greploop

    onyx-dot-app/onyx

    Iteratively improves a PR (GitHub), MR (GitLab), or shelved changelist (Perforce) until Greptile gives it a 5/5 confidence score with zero unresolved comments.

    32k GitHub starsUsed in 4 repos~3.3k tokens
    DevelopmentAuto-check passed

  • Update V8 Version

    openinterpreter/openinterpreter

    Bumps the pinned v8 and rusty_v8 versions in Codex, validates the release-candidate path with the v8-canary check, and traces failures to upstream build changes.

    69k GitHub starsUsed in 2 repos~845 tokens
    DevOps & CloudAuto-check passed

  • Check PR

    onyx-dot-app/onyx

    Checks a GitHub, GitLab, or Perforce (p4) pull request (or merge request, or shelved changelist) for unresolved review comments, failing status checks, and incomplete PR descriptions.

    32k GitHub starsUsed in 2 repos~2.3k tokens
    DevelopmentAuto-check passed

More from github/gh-aw

All 52 skills in this repo

  • playwright-cli Browser Automation

    github/gh-aw

    Official

    Drives a real browser from the command line with playwright-cli to open pages, interact, mock requests, save state and work with Playwright tests.

    5.3k GitHub starsUsed in 23 repos~2.8k tokens
    Auto-check passed

  • Operational Value Designer

    github/gh-aw

    Official

    Designs and verifies a deterministic grader that measures whether a GitHub Agentic Workflow run reached its real-world or repository outcome.

    5.3k GitHub stars~6.8k tokensUpdated today
    Auto-check passed

  • Copilot Canvas Extension Author

    github/gh-aw

    Official

    Scaffolds, edits, reloads and debugs a canvas extension that the GitHub Copilot CLI can open in its side panel.

    5.3k GitHub stars~3.7k tokensUpdated today
    Auto-check passed

  • GitHub Copilot PR Finisher

    github/gh-aw

    Official

    Drives an open pull request to merge-ready from inside a GitHub Copilot cloud agent, resolving review threads and local checks concurrently, without merging or retriggering CI.

    5.3k GitHub stars~3.8k tokensUpdated today
    Auto-check: warnings

  • gh-aw Firewall Release Integrator

    github/gh-aw

    Official

    Bumps gh-aw's pinned gh-aw-firewall version, rebuilds generated artifacts, and flags upstream spec or schema changes that need follow-up work.

    5.3k GitHub stars~899 tokensUpdated today
    Auto-check passed

  • gh-aw Console Rendering Tags

    github/gh-aw

    Official

    Guide to the console struct tag system in gh-aw: headers, titles, number and cost formats, omitempty, and how structs, slices and maps render in the terminal.

    5.3k GitHub stars~736 tokensUpdated today
    Auto-check passed

Works with

Questions about Security Advisory Compat Enforcer

What does Security Advisory Compat Enforcer do?

Review a GitHub security advisory and safely update .github/aw/compat.json with evidence-backed version enforcement. Security Advisory Compat Enforcer is an agent skill from github/gh-aw, published by the product's own GitHub organization.json with evidence-backed version enforcement.

How do I install Security Advisory Compat Enforcer in Claude Code?

Run `npx skills add github/gh-aw --skill security-advisory-compat-enforcer -a claude-code`. Or copy the skill folder (.github/skills/security-advisory-compat-enforcer in github/gh-aw) into .claude/skills/security-advisory-compat-enforcer in your project. Claude Code loads it when a task matches its description.

How do I install Security Advisory Compat Enforcer in Codex?

Run `npx skills add github/gh-aw --skill security-advisory-compat-enforcer -a codex`. Or copy the skill folder (.github/skills/security-advisory-compat-enforcer in github/gh-aw) into .agents/skills/security-advisory-compat-enforcer in your project. Codex loads it when a task matches its description.

Can I use Security Advisory Compat Enforcer in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add github/gh-aw --skill security-advisory-compat-enforcer -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-advisory-compat-enforcer, .gemini/skills/security-advisory-compat-enforcer, .github/skills/security-advisory-compat-enforcer and .opencode/skills/security-advisory-compat-enforcer in your project.

What does Security Advisory Compat Enforcer need to run?

Going by SKILL.md and its folder, Security Advisory Compat Enforcer needs the command-line tools its instructions call (gh).

Does Security Advisory Compat Enforcer access the network?

SKILL.md contains no URLs. Its commands use gh, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Security Advisory Compat Enforcer safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Security Advisory Compat Enforcer use?

Security Advisory Compat Enforcer is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security Advisory Compat Enforcer use?

About 1.5k tokens (SKILL.md is roughly 6.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security Advisory Compat Enforcer?

Skills that share tags, products or a category with Security Advisory Compat Enforcer: PR Babysitter (openinterpreter/openinterpreter, 69k stars), Diagnosing Superpowers Sessions (obra/superpowers, 296k stars), GitHub Deep Research (bytedance/deer-flow, 83k stars) and Greploop (onyx-dot-app/onyx, 32k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security Advisory Compat Enforcer?

github (a GitHub organization, an official publisher) maintains it in github/gh-aw, which has 5,350 GitHub stars. The repository holds 52 skills in this directory. The repository was last updated on October 7, 2026.

Source: github/gh-aw on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.