> **GitHub projects only.** This skill assumes the project's primary > development activity is on GitHub and uses the GitHub CLI (`gh`) for > all data collection. Most ASF projects use GitHub, but some remain on > Apache GitBox (Gitea) or use other forges. If your project is not > on GitHub, this sk

> **GitHub projects only.** This skill assumes the project's primary > development activity is on GitHub and uses the GitHub CLI (`gh`) for > all data collection. Most ASF projects use GitHub, but some remain on > Apache GitBox (Gitea) or use other forges. If your project is not > on GitHub, the aut

Generate a CVE 5.x JSON document from an <tracker> tracking issue, ready to paste into the Vulnogram `#source` tab of the ASF CVE tool at https://cveprocess.apache.org/cve5/<CVE-ID>#source. The conversion is deterministic: same issue in, same JSON bytes out. Handles multiple credits (one per line) and multiple references (URLs extracted from the issue's "Public advisory URL" and "PR with the fix" fields; the "Security mailing list thread" field is treated as internal-only and never exported).

This skill drafts a code fix for a single `<issue-tracker>` issue that has already been triaged as actionable (classification `BUG` or `FEATURE-REQUEST` per [`issue-triage`](../issue-triage/SKILL.md)). It produces the failing test, the smallest production change, the targeted and module test-run res

Use this skill when the task is a **campaign** over a bounded set of resolved or end-of-life `<issue-tracker>` issues: pick the candidate set, run each reporter's reproducer against `<default-branch>` via [`issue-reproducer`](../issue-reproducer/SKILL.md), classify the outcome, attach a nature analy

Print a human-readable index of the skills in this repository. The index is generated on every run from the live `.claude/skills/*/SKILL.md` files — there is no cached copy to keep in sync. The skill exists for humans (newcomers reading the repo, maintainers checking what is available); agents rou

Draft a single net-new *good first issue* on the configured `<upstream>` repo from one supplied candidate such as a known gap or a small maintainer-named task. The skill first runs a suitability gate to confirm the candidate is small and newcomer-safe. If it passes the skill drafts one issue. The draft carries scope, code pointers, contributing-doc links, acceptance criteria, and an effort estimate. A readiness checklist gates the draft before it is shown. Nothing is filed via `gh` until the maintainer explicitly confirms. The skill never curates or relabels the existing backlog.

Commit + push the user's shared Claude config to the `~/.claude-config` private dotfile-style sync repo. Inspects for uncommitted local edits and unpushed commits, drafts a commit message, and after explicit approval commits and pushes. Runs `git pull --rebase` first if the local checkout is behind, so a push never overwrites concurrent work from another machine. Never force-pushes; never rewrites already-pushed history; never modifies files outside `~/.claude-config/`.

Author a new skill for the Apache Steward framework, or update an existing one. Walks the user through the framework's skill shape (frontmatter, resources, placeholder convention, prompt-injection defences, Privacy-LLM gate-check) and validates via the framework's existing [`tools/skill-and-tool-validator`](../../tools/skill-and-tool-validator/). Scaffolds new skills via `init_skill.py`.

This skill walks a maintainer through **deep, line-aware review** of open pull requests, **one PR at a time**. Its job is to answer two questions per PR:

This skill is the **pre-flight self-review** entry point for the Pairing mode family. It runs in the developer's own dev loop — after local changes are ready but before opening a PR — and returns a structured review report. The report replaces implementation-detail chatter so the eventual human-

**Status: experimental.** First prototype of Mode B ([conversational mentoring](../../../docs/mentoring/spec.md)). The skill exists to make the spec executable on a single thread at a time so we can iterate on tone wording, convention pointers, and hand-off triggers against real contributor traffic

This skill answers one question for the `ready for maintainer review` queue:

Merge two <tracker> tracking issues that describe the same root-cause vulnerability (typically discovered independently by two reporters, arriving via different channels), preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector description. Updates the kept issue's body in place, closes the duplicate with the `duplicate` label, and regenerates the CVE JSON attachment so both finders land in `credits[]`.

This skill is the **on-ramp** of the security-issue handling process. It converts an inbound `<security-list>` email thread into an `<tracker>` tracking issue that follows the repo's issue template, then drafts the receipt-of-confirmation reply to the reporter.

This skill is the **batch on-ramp** of the security-issue handling process for the case where the security team has a markdown file containing one or more pre-formatted security findings — typically the output of an AI security review run against an `<upstream>` branch, or a third-party scanner ex

This skill is an alternative on-ramp of the security-issue handling process for the case where the report **never arrived on `<security-list>`**. A contributor opened a public fix in `<upstream>`; somebody on the security team noticed it is security-relevant; the team decided informally that the fix

Synchronize a security issue in <tracker> with the state of its GitHub discussion, the <security-list> mailing thread, and any <upstream> PRs that fix it. The skill gathers all relevant signals, proposes label, milestone, assignee, field and draft-email updates, and only applies changes the user has explicitly confirmed. Suggests the next step in the handling process and prints the CVE allocation link when a CVE is needed.

This skill is the **initial-triage discussion-starter** for security tracker issues. For each [`<tracker>`](https://github.com/<tracker>) issue carrying the `needs triage` label, it reads the body + comments, applies the project's Security Model framing, classifies the candidate disposition, and —

Read-only skill that renders a self-contained HTML page summarising the state of `<tracker>` over time. The skill wraps the [`tools/security-tracker-stats-dashboard/`](../../../tools/security-tracker-stats-dashboard/README.md) runtime tool — both the slash-command path (this skill) and the script