Run any Skill in Manus with one click

security-investigate-report

Stars2

Forks3

UpdatedJuly 2, 2026 at 11:19

Triages an incoming security report for Open Collective codebases - searches `priv/security-issues` and opencollective/opencollective-security first for existing documentation, validates reproducibility and impact when new, maps to official bounty policy, proposes fixes, and drafts contributor replies. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including up to three core markdown files (`reply.md`, optional `issue.md` when fully confirmed, optional `plan.md` when there is a fix to plan), plus a minimal runnable PoC for full confirmation. Updates `security/memory.md` after full triage. After triage, offers optional production impact analysis (`impact.md`) and filing on opencollective/opencollective-security. Use when the user pastes or describes a security report, asks to investigate a vulnerability, assess bounty eligibility, or draft a response to security@opencollective.com reporters.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

opencollective

opencollective/monorepo

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name

security-investigate-report

description

Security report investigation (Open Collective)

Canonical policy: SECURITY.md (eligibility, scope, qualifying/non-qualifying, rewards, contact). This skill does not replace human sign-off on bounties or payouts.

Shared triage steps: Read ../security-investigate/_shared.md for issue folder rules, known issue check (local priv/security-issues archive + GitHub MCP search of opencollective-security), core workflow (parse → PoC → classify → severity → fix), security/memory.md update, and plan.md / impact.md structure.

Report ID (when provided)

Capture any security report ID (ticket, email subject id, internal code) at the start. Do not invent one.

reply.md / expense instructions: Use the real ID when bounty or payment is discussed; otherwise __SECURITY_REPORT_ID__ (reporter replaces per team process).
issue.md: Report ID: line near the top when fully confirmed. Title = concise finding description, not a PR/commit title.

Known issue match (report-specific)

When _shared.md finds a match (in priv/security-issues, on GitHub, or both): reply.md only. Cite prior triage folder path and/or existing GitHub issue URL/number and status. Note duplicates are generally not eligible for a separate bounty per SECURITY.md; do not promise payment. Do not offer to file a new opencollective-security issue. Do not update security/memory.md (canonical entry should already exist).

Full triage workflow

Prerequisite: Known issue check passed (local + GitHub). Create issue folder, then:

Steps 1–6 from _shared.md (parse through fix plan). For classify (step 4), also check SECURITY.md Qualifying / Non-qualifying lists.
Contributor reply - Professional, paste-ready reply.md (templates below). Apply Report ID when bounty/expense applies.
Policy compliance (fully confirmed + possible bounty) - Walk SECURITY.md Eligibility, Responsible Disclosure, and Scope. Flag gaps (missing policy sentence, production-only testing, scanner-only, hypothetical without PoC). Verdict: recommended / not eligible / needs more info. Do not promise payment.
Bounty recommendation - If eligible, map to Rewards table (project type, Low/Medium/High/Critical band). Note sanctions/payment-processor limits if relevant. Expense: https://opencollective.com/ofitech/expenses/new with report ID (see Report ID).
issue.md - Only when fully confirmed (PoC run). GitHub body for opencollective-security: report ID, title suggestion, summary, impact, components, code refs, PoC path/run instructions, severity, label hints. Engineering handoff, not a copy of the email.
security/memory.md - Per _shared.md (reporter section, title, date, bounty or —).
End-of-triage offers - After in-chat summary, offer production impact analysis and GitHub issue filing (see below). Do not run either by default.

Output files

All under /workspace/priv/security-issues/<unique-folder>/. PoC in poc/ or poc.*; required for fully confirmed. Skip files that do not apply.

File	When	Contents
`reply.md`	Always	Paste-ready researcher reply: verdict, thanks, bounty/expense when applicable (see Report ID). State provisional clearly if PoC not run.
`issue.md`	Fully confirmed only	opencollective-security issue body (see workflow step 5).
`plan.md`	Fix to plan	Per _shared.md.
`impact.md`	User accepts impact offer	Per _shared.md. Do not create during default triage.

Reply templates (adapt; keep accurate and kind)

Known issue / duplicate - Thanks; prior triage (priv/security-issues/…) and/or known GitHub issue + link/number/status; duplicates generally not eligible for separate bounty; invite follow-up if they believe it is a distinct flaw; optional report ID for correlation.

Invalid / non-issue - Thanks; conclusion (cannot reproduce, not a defect, out of scope, Non-qualifying with brief rationale); point to staging/docs if helpful; no bounty unless a separate valid finding.

Fully confirmed - Thanks; validated via minimal PoC in permitted environment (minimal exploit detail if undisclosed); next steps; if eligibility appears met, bounty tier/band per SECURITY.md and note any uncertainty (first reporter, 72h rule, etc.); expense URL + Report ID.

End-of-triage offers (optional)

After the in-chat summary, offer both follow-ups below. Do not run either during default triage; wait for user acceptance.

Production impact analysis

When abuse may leave queryable traces (DB rows, audit logs, etc.).

Offer when: Fully or provisionally confirmed findings where forensic checks could clarify whether exploitation occurred in production.
On accept: Write impact.md per _shared.md and note the new file in chat.

GitHub issue

Offer to create on opencollective/opencollective-security. Do not create without user acceptance. Do not use browser automation.

Offer when: Fully confirmed + issue.md (primary); provisional/invalid only if user may want a record.
On accept: GitHub MCP available; read schema (issue_write create, etc.). Title/body from issue.md when present; no secrets or raw exploit steps if undisclosed. Use existing labels only. Return issue URL or leave issue.md for manual paste at New issue.

In-chat summary

Duplicate path: (1) Verdict + prior triage folder and/or existing GitHub issue link (2) Search queries and why same finding (local + GitHub) (3) Folder path + reply.md.

Full triage path: (1) Duplicate check note (local + GitHub) (2) Verdict + reason (3) Evidence + PoC if confirmed (4) Impact (theoretical; in reply.md / issue.md — not production forensic queries) (5) Severity (6) Fix plan pointer (7) Bounty eligibility/band/compliance + report ID (8) security/memory.md updated (9) Folder path + files written + PoC path (10) Offer production impact analysis (impact.md) when queryable traces may exist (11) Offer opencollective-security issue when applicable — only run either after user accepts

More from this repository

same repository

security-investigate-issue

opencollective/monorepo

Triages an internally reported security concern for Open Collective codebases (engineering, ops, or security team) - validates reproducibility and impact, asserts the finding with a clear confidence level, and proposes a fix plan when applicable. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including `issue.md` (assertion and verdict), optional `plan.md` when there is a fix to plan, plus a minimal runnable PoC for full confirmation. Offers optional production impact analysis (`impact.md`) at the end when queryable traces may exist. Updates `security/memory.md` after full triage. No external researcher reply or bounty policy. Use when the user describes an internal finding, asks to validate a suspected vulnerability from the team, or wants an engineering handoff without security@ or bounty workflow.

2026-07-022

documentation-feature-pr

opencollective/monorepo

Drafts user-facing documentation in opencollective-documentation for a requested frontend feature, then offers to commit and open a PR. Pulls latest docs first, checks open PRs via GitHub MCP for duplicates, verifies against frontend code and GitBook. Use when the user invokes /documentation-feature-pr, asks to document a feature, update user docs, or open a documentation PR for a specific workflow.

2026-06-112

generate-cycle-report

opencollective/monorepo

Generates a concise, end-user-oriented markdown report of Open Collective achievements for a completed engineering cycle. Pulls planned work from org project 5 and opencollective/opencollective milestone issues, then supplements with API and frontend commit history for work not tracked on the board. Use when the user invokes /generate-cycle-report, asks for a cycle recap, achievements report, or what shipped in the past cycle.

2026-06-112

support-ticket-reply

opencollective/monorepo

Drafts paste-ready email replies to Open Collective support tickets by researching user-facing documentation and product behavior. Searches GitBook docs and the local documentation repo for relevant pages and includes links when helpful. Use when the user pastes a support ticket, asks to reply to a support email, draft a help desk response, or invokes /support-ticket-reply.

2026-06-112

i18n-frontend-translate

opencollective/monorepo

Batches translation of opencollective-frontend locale JSON using show-untranslated and set-translation scripts, with codebase lookup for message IDs when context is unclear. Use when the user asks to translate frontend strings, reduce untranslated entries for a locale, or apply translation rules to lang files.

2026-06-082

review-feature-security

opencollective/monorepo

Performs a structured security review of a specific feature, PR, or code change in the Open Collective codebase. Validates findings with a minimal runnable PoC when claiming full confirmation. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including `issue.md` per finding, optional `plan.md`, optional `impact.md`, plus PoC code. Use when asked to review the security of a new feature, a pull request, or a code change.

2026-06-032

name

security-investigate-report

description

Security report investigation (Open Collective)

Canonical policy: SECURITY.md (eligibility, scope, qualifying/non-qualifying, rewards, contact). This skill does not replace human sign-off on bounties or payouts.

Report ID (when provided)

Capture any security report ID (ticket, email subject id, internal code) at the start. Do not invent one.

reply.md / expense instructions: Use the real ID when bounty or payment is discussed; otherwise __SECURITY_REPORT_ID__ (reporter replaces per team process).
issue.md: Report ID: line near the top when fully confirmed. Title = concise finding description, not a PR/commit title.

Known issue match (report-specific)

Full triage workflow

Prerequisite: Known issue check passed (local + GitHub). Create issue folder, then:

Steps 1–6 from _shared.md (parse through fix plan). For classify (step 4), also check SECURITY.md Qualifying / Non-qualifying lists.
Contributor reply - Professional, paste-ready reply.md (templates below). Apply Report ID when bounty/expense applies.
Policy compliance (fully confirmed + possible bounty) - Walk SECURITY.md Eligibility, Responsible Disclosure, and Scope. Flag gaps (missing policy sentence, production-only testing, scanner-only, hypothetical without PoC). Verdict: recommended / not eligible / needs more info. Do not promise payment.
Bounty recommendation - If eligible, map to Rewards table (project type, Low/Medium/High/Critical band). Note sanctions/payment-processor limits if relevant. Expense: https://opencollective.com/ofitech/expenses/new with report ID (see Report ID).
issue.md - Only when fully confirmed (PoC run). GitHub body for opencollective-security: report ID, title suggestion, summary, impact, components, code refs, PoC path/run instructions, severity, label hints. Engineering handoff, not a copy of the email.
security/memory.md - Per _shared.md (reporter section, title, date, bounty or —).
End-of-triage offers - After in-chat summary, offer production impact analysis and GitHub issue filing (see below). Do not run either by default.

Output files

All under /workspace/priv/security-issues/<unique-folder>/. PoC in poc/ or poc.*; required for fully confirmed. Skip files that do not apply.

File	When	Contents
`reply.md`	Always	Paste-ready researcher reply: verdict, thanks, bounty/expense when applicable (see Report ID). State provisional clearly if PoC not run.
`issue.md`	Fully confirmed only	opencollective-security issue body (see workflow step 5).
`plan.md`	Fix to plan	Per _shared.md.
`impact.md`	User accepts impact offer	Per _shared.md. Do not create during default triage.

Reply templates (adapt; keep accurate and kind)

End-of-triage offers (optional)

After the in-chat summary, offer both follow-ups below. Do not run either during default triage; wait for user acceptance.

Production impact analysis

When abuse may leave queryable traces (DB rows, audit logs, etc.).

Offer when: Fully or provisionally confirmed findings where forensic checks could clarify whether exploitation occurred in production.
On accept: Write impact.md per _shared.md and note the new file in chat.

GitHub issue

Offer to create on opencollective/opencollective-security. Do not create without user acceptance. Do not use browser automation.

Offer when: Fully confirmed + issue.md (primary); provisional/invalid only if user may want a record.
On accept: GitHub MCP available; read schema (issue_write create, etc.). Title/body from issue.md when present; no secrets or raw exploit steps if undisclosed. Use existing labels only. Return issue URL or leave issue.md for manual paste at New issue.

In-chat summary

Duplicate path: (1) Verdict + prior triage folder and/or existing GitHub issue link (2) Search queries and why same finding (local + GitHub) (3) Folder path + reply.md.