Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

security-investigate-report

Estrellas2

Forks3

Actualizado2 de julio de 2026, 11:19

Triages an incoming security report for Open Collective codebases - searches `priv/security-issues` and opencollective/opencollective-security first for existing documentation, validates reproducibility and impact when new, maps to official bounty policy, proposes fixes, and drafts contributor replies. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including up to three core markdown files (`reply.md`, optional `issue.md` when fully confirmed, optional `plan.md` when there is a fix to plan), plus a minimal runnable PoC for full confirmation. Updates `security/memory.md` after full triage. After triage, offers optional production impact analysis (`impact.md`) and filing on opencollective/opencollective-security. Use when the user pastes or describes a security report, asks to investigate a vulnerability, assess bounty eligibility, or draft a response to security@opencollective.com reporters.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

opencollective

opencollective/monorepo

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name

security-investigate-report

description

Security report investigation (Open Collective)

Canonical policy: SECURITY.md (eligibility, scope, qualifying/non-qualifying, rewards, contact). This skill does not replace human sign-off on bounties or payouts.

Shared triage steps: Read ../security-investigate/_shared.md for issue folder rules, known issue check (local priv/security-issues archive + GitHub MCP search of opencollective-security), core workflow (parse → PoC → classify → severity → fix), security/memory.md update, and plan.md / impact.md structure.

Report ID (when provided)

Capture any security report ID (ticket, email subject id, internal code) at the start. Do not invent one.

reply.md / expense instructions: Use the real ID when bounty or payment is discussed; otherwise __SECURITY_REPORT_ID__ (reporter replaces per team process).
issue.md: Report ID: line near the top when fully confirmed. Title = concise finding description, not a PR/commit title.

Known issue match (report-specific)

When _shared.md finds a match (in priv/security-issues, on GitHub, or both): reply.md only. Cite prior triage folder path and/or existing GitHub issue URL/number and status. Note duplicates are generally not eligible for a separate bounty per SECURITY.md; do not promise payment. Do not offer to file a new opencollective-security issue. Do not update security/memory.md (canonical entry should already exist).

Full triage workflow

Prerequisite: Known issue check passed (local + GitHub). Create issue folder, then:

Steps 1–6 from _shared.md (parse through fix plan). For classify (step 4), also check SECURITY.md Qualifying / Non-qualifying lists.
Contributor reply - Professional, paste-ready reply.md (templates below). Apply Report ID when bounty/expense applies.
Policy compliance (fully confirmed + possible bounty) - Walk SECURITY.md Eligibility, Responsible Disclosure, and Scope. Flag gaps (missing policy sentence, production-only testing, scanner-only, hypothetical without PoC). Verdict: recommended / not eligible / needs more info. Do not promise payment.
Bounty recommendation - If eligible, map to Rewards table (project type, Low/Medium/High/Critical band). Note sanctions/payment-processor limits if relevant. Expense: https://opencollective.com/ofitech/expenses/new with report ID (see Report ID).
issue.md - Only when fully confirmed (PoC run). GitHub body for opencollective-security: report ID, title suggestion, summary, impact, components, code refs, PoC path/run instructions, severity, label hints. Engineering handoff, not a copy of the email.
security/memory.md - Per _shared.md (reporter section, title, date, bounty or —).
End-of-triage offers - After in-chat summary, offer production impact analysis and GitHub issue filing (see below). Do not run either by default.

Output files

All under /workspace/priv/security-issues/<unique-folder>/. PoC in poc/ or poc.*; required for fully confirmed. Skip files that do not apply.

File	When	Contents
`reply.md`	Always	Paste-ready researcher reply: verdict, thanks, bounty/expense when applicable (see Report ID). State provisional clearly if PoC not run.
`issue.md`	Fully confirmed only	opencollective-security issue body (see workflow step 5).
`plan.md`	Fix to plan	Per _shared.md.
`impact.md`	User accepts impact offer	Per _shared.md. Do not create during default triage.

Reply templates (adapt; keep accurate and kind)

Known issue / duplicate - Thanks; prior triage (priv/security-issues/…) and/or known GitHub issue + link/number/status; duplicates generally not eligible for separate bounty; invite follow-up if they believe it is a distinct flaw; optional report ID for correlation.

Invalid / non-issue - Thanks; conclusion (cannot reproduce, not a defect, out of scope, Non-qualifying with brief rationale); point to staging/docs if helpful; no bounty unless a separate valid finding.

Fully confirmed - Thanks; validated via minimal PoC in permitted environment (minimal exploit detail if undisclosed); next steps; if eligibility appears met, bounty tier/band per SECURITY.md and note any uncertainty (first reporter, 72h rule, etc.); expense URL + Report ID.

End-of-triage offers (optional)

After the in-chat summary, offer both follow-ups below. Do not run either during default triage; wait for user acceptance.

Production impact analysis

When abuse may leave queryable traces (DB rows, audit logs, etc.).

Offer when: Fully or provisionally confirmed findings where forensic checks could clarify whether exploitation occurred in production.
On accept: Write impact.md per _shared.md and note the new file in chat.

GitHub issue

Offer to create on opencollective/opencollective-security. Do not create without user acceptance. Do not use browser automation.

Offer when: Fully confirmed + issue.md (primary); provisional/invalid only if user may want a record.
On accept: GitHub MCP available; read schema (issue_write create, etc.). Title/body from issue.md when present; no secrets or raw exploit steps if undisclosed. Use existing labels only. Return issue URL or leave issue.md for manual paste at New issue.

In-chat summary

Duplicate path: (1) Verdict + prior triage folder and/or existing GitHub issue link (2) Search queries and why same finding (local + GitHub) (3) Folder path + reply.md.

Full triage path: (1) Duplicate check note (local + GitHub) (2) Verdict + reason (3) Evidence + PoC if confirmed (4) Impact (theoretical; in reply.md / issue.md — not production forensic queries) (5) Severity (6) Fix plan pointer (7) Bounty eligibility/band/compliance + report ID (8) security/memory.md updated (9) Folder path + files written + PoC path (10) Offer production impact analysis (impact.md) when queryable traces may exist (11) Offer opencollective-security issue when applicable — only run either after user accepts

Más de este repositorio

mismo repositorio

security-investigate-issue

opencollective/monorepo

Triages an internally reported security concern for Open Collective codebases (engineering, ops, or security team) - validates reproducibility and impact, asserts the finding with a clear confidence level, and proposes a fix plan when applicable. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including `issue.md` (assertion and verdict), optional `plan.md` when there is a fix to plan, plus a minimal runnable PoC for full confirmation. Offers optional production impact analysis (`impact.md`) at the end when queryable traces may exist. Updates `security/memory.md` after full triage. No external researcher reply or bounty policy. Use when the user describes an internal finding, asks to validate a suspected vulnerability from the team, or wants an engineering handoff without security@ or bounty workflow.

2026-07-022

documentation-feature-pr

opencollective/monorepo

Drafts user-facing documentation in opencollective-documentation for a requested frontend feature, then offers to commit and open a PR. Pulls latest docs first, checks open PRs via GitHub MCP for duplicates, verifies against frontend code and GitBook. Use when the user invokes /documentation-feature-pr, asks to document a feature, update user docs, or open a documentation PR for a specific workflow.

2026-06-112

generate-cycle-report

opencollective/monorepo

Generates a concise, end-user-oriented markdown report of Open Collective achievements for a completed engineering cycle. Pulls planned work from org project 5 and opencollective/opencollective milestone issues, then supplements with API and frontend commit history for work not tracked on the board. Use when the user invokes /generate-cycle-report, asks for a cycle recap, achievements report, or what shipped in the past cycle.

2026-06-112

support-ticket-reply

opencollective/monorepo

Drafts paste-ready email replies to Open Collective support tickets by researching user-facing documentation and product behavior. Searches GitBook docs and the local documentation repo for relevant pages and includes links when helpful. Use when the user pastes a support ticket, asks to reply to a support email, draft a help desk response, or invokes /support-ticket-reply.

2026-06-112

i18n-frontend-translate

opencollective/monorepo

Batches translation of opencollective-frontend locale JSON using show-untranslated and set-translation scripts, with codebase lookup for message IDs when context is unclear. Use when the user asks to translate frontend strings, reduce untranslated entries for a locale, or apply translation rules to lang files.

2026-06-082

review-feature-security

opencollective/monorepo

Performs a structured security review of a specific feature, PR, or code change in the Open Collective codebase. Validates findings with a minimal runnable PoC when claiming full confirmation. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including `issue.md` per finding, optional `plan.md`, optional `impact.md`, plus PoC code. Use when asked to review the security of a new feature, a pull request, or a code change.

2026-06-032

name

security-investigate-report

description

Security report investigation (Open Collective)

Canonical policy: SECURITY.md (eligibility, scope, qualifying/non-qualifying, rewards, contact). This skill does not replace human sign-off on bounties or payouts.

Report ID (when provided)

Capture any security report ID (ticket, email subject id, internal code) at the start. Do not invent one.

reply.md / expense instructions: Use the real ID when bounty or payment is discussed; otherwise __SECURITY_REPORT_ID__ (reporter replaces per team process).
issue.md: Report ID: line near the top when fully confirmed. Title = concise finding description, not a PR/commit title.

Known issue match (report-specific)

Full triage workflow

Prerequisite: Known issue check passed (local + GitHub). Create issue folder, then:

Steps 1–6 from _shared.md (parse through fix plan). For classify (step 4), also check SECURITY.md Qualifying / Non-qualifying lists.
Contributor reply - Professional, paste-ready reply.md (templates below). Apply Report ID when bounty/expense applies.
Policy compliance (fully confirmed + possible bounty) - Walk SECURITY.md Eligibility, Responsible Disclosure, and Scope. Flag gaps (missing policy sentence, production-only testing, scanner-only, hypothetical without PoC). Verdict: recommended / not eligible / needs more info. Do not promise payment.
Bounty recommendation - If eligible, map to Rewards table (project type, Low/Medium/High/Critical band). Note sanctions/payment-processor limits if relevant. Expense: https://opencollective.com/ofitech/expenses/new with report ID (see Report ID).
issue.md - Only when fully confirmed (PoC run). GitHub body for opencollective-security: report ID, title suggestion, summary, impact, components, code refs, PoC path/run instructions, severity, label hints. Engineering handoff, not a copy of the email.
security/memory.md - Per _shared.md (reporter section, title, date, bounty or —).
End-of-triage offers - After in-chat summary, offer production impact analysis and GitHub issue filing (see below). Do not run either by default.

Output files

All under /workspace/priv/security-issues/<unique-folder>/. PoC in poc/ or poc.*; required for fully confirmed. Skip files that do not apply.

File	When	Contents
`reply.md`	Always	Paste-ready researcher reply: verdict, thanks, bounty/expense when applicable (see Report ID). State provisional clearly if PoC not run.
`issue.md`	Fully confirmed only	opencollective-security issue body (see workflow step 5).
`plan.md`	Fix to plan	Per _shared.md.
`impact.md`	User accepts impact offer	Per _shared.md. Do not create during default triage.

Reply templates (adapt; keep accurate and kind)

End-of-triage offers (optional)

After the in-chat summary, offer both follow-ups below. Do not run either during default triage; wait for user acceptance.

Production impact analysis

When abuse may leave queryable traces (DB rows, audit logs, etc.).

Offer when: Fully or provisionally confirmed findings where forensic checks could clarify whether exploitation occurred in production.
On accept: Write impact.md per _shared.md and note the new file in chat.

GitHub issue

Offer to create on opencollective/opencollective-security. Do not create without user acceptance. Do not use browser automation.

Offer when: Fully confirmed + issue.md (primary); provisional/invalid only if user may want a record.
On accept: GitHub MCP available; read schema (issue_write create, etc.). Title/body from issue.md when present; no secrets or raw exploit steps if undisclosed. Use existing labels only. Return issue URL or leave issue.md for manual paste at New issue.

In-chat summary

Duplicate path: (1) Verdict + prior triage folder and/or existing GitHub issue link (2) Search queries and why same finding (local + GitHub) (3) Folder path + reply.md.