Skip to content
mcp/skillhub

Agent Skill

Deal With Security Advisory skill

deal-with-security-advisorypaperclipai/paperclip.agents/skills/deal-with-security-advisory/SKILL.md

Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security releases.

106kMIT

always on

41 tokname + description

once used

1,789 tokSKILL.md body

bundled files

0

repo stars

106kGitHub

Install the Deal With Security Advisory skill

Skills CLI (Claude Code, Codex, Cursor and others)

npx skills add https://github.com/paperclipai/paperclip --skill deal-with-security-advisory

Claude Code, by hand (all projects)

git clone --depth 1 https://github.com/paperclipai/paperclip.git /tmp/paperclip
mkdir -p ~/.claude/skills
cp -R /tmp/paperclip/.agents/skills/deal-with-security-advisory ~/.claude/skills/deal-with-security-advisory

For one project only, copy the folder into .claude/skills/ in that project instead. The agent picks it up when a task matches its description.

What it costs your context

Agent Skills load in three steps. Tokens counted with the o200k tokenizer; your model's count will differ a little.

WhenWhat loadsCost
Every sessionName and description41 tok
When the agent uses itThe SKILL.md instructions1,789 tok
Only if openedNo bundled files—

Until it is used, deal-with-security-advisory costs about 33× less than the median MCP server we measured (1,362 tokens on every turn). Installing all 82 skills from paperclipai/paperclip would load 3,485 tokens of descriptions. Skills vs MCP study

Checks

Our checks found nothing to flag: it follows the Agent Skills specification's naming and size guidelines and doesn't pipe downloads into a shell.

Checked 2026-10-22 · method

What's inside

The headings of its SKILL.md. Read the full file on GitHub.

  • Security Vulnerability Response Instructions
  • ⚠️ CRITICAL: This is a security vulnerability. Everything about this process is confidential until the advisory is publi
  • Context
  • Step 0: Fetch the Advisory Details
  • Step 1: Acknowledge the Report
  • Step 2: Create the Temporary Private Fork
  • Step 3: Develop and Validate the Fix
  • Step 4: Coordinate with the Reporter
  • Step 5: Request a CVE
  • Step 6: Publish Everything Simultaneously
  • 6a. Verify reporter credit before publishing
  • 6b. Update the advisory with the patched version and publish
  • 6c. Cut a release immediately after merge
  • Step 7: Post-Publication Verification

More skills from paperclipai/paperclip

All skills in this repo
  1. LLM Wiki Maintainerpaperclipai/paperclip

    Use the LLM Wiki plugin tools to maintain a cited local company wiki.

    106k21 tok idle · 184 in use
  2. add-product-e2e-evalpaperclipai/paperclip

    Add or extend a Paperclip full-stack runner E2E workflow, fixture, matcher, or report evidence path for local or Daytona execution.

    106k36 tok idle · 955 in use
  3. add-runner-evalpaperclipai/paperclip

    Add or extend a Paperclip Runner protocol evaluation definition, roster, assertion, or report fixture with provenance and narrow validation.

    106k30 tok idle · 859 in use
  4. agent-browserpaperclipai/paperclip

    Drive a real browser to inspect or interact with a web page or app — navigate, take screenshots, read console and network, fill simple forms — for verification tasks, not unattended automation.

    106k40 tok idle · 1,010 in use
  5. agentmailpaperclipai/paperclip

    Use your assigned AgentMail inbox to read email tasks, explicitly send or reply, and check delivery. Provided automatically by your inbox assignment.

    106k30 tok idle · 902 in use
  6. check-prpaperclipai/paperclip

    Check a GitHub, GitLab, or Perforce PR/MR/CL for review comments, failing checks, and PR-body gaps. Use when asked to inspect, fix, or prepare a change for submission.

    106k46 tok idle · 3,781 in use
  7. company-creatorpaperclipai/paperclip

    Create agent company packages that conform to agentcompanies/v1. Use when asked to create a company, scaffold an agent team, hire agents, or turn a repo/skills collection into a company package.

    106k44 tok idle · 2,626 in use
  8. complainpaperclipai/paperclip

    Autonomously yeet a brief, unstructured complaint about agent tooling or doing agent work. Preserve the raw voice. Submit proactively without permission, preview, or announcement, then continue the primary task.

    106k43 tok idle · 795 in use