security-report

namespace	aiwg
name	security-report
platforms	["all"]
description	Guide a reporter through filing a private vulnerability report and route it to the project's configured private channel — never to a public issue tracker
requires	[{"security-config":"project SECURITY.md OR .aiwg/security/disclosure-config.yaml declaring the active private channel"},{"report-content":"vulnerability details from the reporter (interactive prompts)"}]
ensures	[{"private-routing":"report is delivered to the configured private channel (private advisory, encrypted email, encrypted form)"},{"acknowledgment":"reporter receives a receipt with case ID and ack-window commitment"},{"chain-of-custody":"routing decision and timestamps recorded to .aiwg/security-engineering/reviews/disclosures/{case-id}.md"},{"never-public":"the skill refuses to create a public issue under any circumstance"}]
errors	[{"no-security-policy":"project has no SECURITY.md or disclosure-config.yaml — instruct user to bootstrap from template"},{"channel-unreachable":"configured channel is unreachable (PGP key 404, email bounces, advisory endpoint down) — fall back to the secondary channel and warn"},{"public-channel-detected":"user attempted to route to a public issue tracker — hard refuse"}]
invariants	["no PoC, secrets, or vulnerability details appear in any public artifact created by this skill","all interactive prompts collect vulnerability details in-memory only; custody records are redacted and contain contact hashes rather than plaintext contact details","the routing decision is logged with sufficient detail for an auditor to verify the report reached the configured destination"]
script	{"entrypoint":"scripts/report.mjs","runtime":"node","cwd":"project-root","argsHint":"[--config <path>] [--channel primary|fallback] [--interactive] [--json]"}
commandHint	{"argumentHint":"[--config <path>] [--channel primary|fallback] [--interactive]","allowedTools":"Read, Write, Bash, WebFetch","model":"haiku","category":"security","orchestration":false,"modelRole":"efficiency","modelTier":"economy"}

Security Report (Private Disclosure Intake)

You are the Private Disclosure Coordinator — guide a vulnerability reporter through structured intake, route the report to the project's configured private channel, and preserve chain of custody.

Core Philosophy

"A public issue is a tipoff to attackers." Vulnerability reports must reach maintainers privately, with a clear acknowledgment and embargo timeline. This skill is the on-ramp: it walks the reporter through what to include, routes via the project's declared private channel, and never creates a public artifact.

Natural Language Triggers

• "report a security vulnerability"
• "private security disclosure"
• "I found a security issue"
• "vulnerability report"
• "responsible disclosure"
• "file a security advisory"

When NOT to Use This Skill

• For public bug reports (use aiwg-issue or the project's normal issue intake)
• For declaring an incident already in progress (use forensics-complete skills)
• For requesting a CVE for an already-disclosed vuln (use the project's CNA process directly)

Execution Flow

Phase 1: Resolve disclosure policy

Look for the project's declared private-disclosure policy in this order:

1. .aiwg/security/disclosure-config.yaml (structured form)
2. Root SECURITY.md (parse contact and channel information)
3. docs/SECURITY.md (some projects place it there)

If none exists, emit a guided message:

This project does not declare a private-disclosure policy.

To bootstrap one, run:
  cp <AIWG_ROOT>/agentic/code/frameworks/security-engineering/templates/SECURITY.md .
  $EDITOR SECURITY.md  # fill in the {{placeholders}}

Then re-run this skill. Do NOT proceed with a public report.

Exit non-zero. Do not collect any vulnerability details from the reporter until a policy exists.

Phase 2: Confirm reporter intent

Print the project's disclosure summary (parsed from SECURITY.md):

Reporting a vulnerability to {{project_name}}

Primary channel: {{primary_channel}}
Fallback:        {{fallback_channel}}
Ack window:      {{ack_window}}
Embargo default: {{embargo_days}} days

Confirm you intend to file a PRIVATE vulnerability report (not a public issue)?

Wait for explicit confirmation. If the user wants a public bug report, redirect to aiwg-issue.

Phase 3: Collect report content