Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Deep split of the security skill family

Cerrado
  • ¿Algo no está bien?
#1,672 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
12/100
Tipo de issue
Refactorización
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
markdown, python
Área
security, tooling

Línea de trabajo

Start with the per-skill table and the measured_tokens: stamps, then read the SKILL.md files for security-issue-import and security-cve-allocate, plus the new tools/security-management package the plan describes. Done means each skill is under the body budget and 500-line cap, with headings and golden-rule headlines unchanged, and skill-token-count, skill-surface-hash, the validator, prek run --all-files and lychee all passing. This is a multi-PR refactor that needs maintainer design input, so it is not a first contribution.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

capability:fix capability:intake capability:resolve capability:triage contract:change-request contract:cve-authority contract:people contract:security-tracker contract:source-control contract:tracker enhancement family:ci family:docs family:security family:tools kind:perf substrate:analytics substrate:framework-dev substrate:sandbox

Part of #1342: the deep split of the security family, the same pattern as pr-management (#1570–#1585) and release-management (#1604–#1625).

The first pass (#1344) was a wording pass. The family is still the largest: 15 skills, 98,884 body tokens in total, 11 over the body budget and 7 over the 500-line cap.

skill body tokens (budget ≈ 5,850 incl. pre-flight) lines (cap 500)
security-issue-import 9,864 ⚠ 561 ⚠
security-issue-import-from-pr 8,447 ⚠ 659 ⚠
security-issue-invalidate 7,582 ⚠ 519 ⚠
security-cve-allocate 7,366 ⚠ 529 ⚠
security-issue-fix 7,163 ⚠ 494
security-issue-triage 7,130 ⚠ 534 ⚠
security-issue-import-from-md 7,095 ⚠ 523 ⚠
security-issue-sync 6,734 ⚠ 483
security-issue-import-via-forwarder 6,213 ⚠ 350
security-issue-deduplicate 5,989 ⚠ 472
security-issue-import-from-scan 5,964 ⚠ 401
security-model-verify 5,611 422
security-model-update 4,821 348
security-model-prepare 4,673 374
security-tracker-stats-dashboard 4,232 325

Body tokens are the measured_tokens: stamps, which include the frontmatter and the generated pre-flight block (~850 tokens together), so the 5,000-token body budget corresponds to about 5,850.

Approach

  • A new tools/security-management package holds the deterministic rules: classification, field extraction, tracker-body and comment rendering, and the scrub checks. The skills call it and keep only judgement and the confirmation gates.
  • SKILL.md becomes a router; rules that serve one sub-action move into one sibling file per backend or outcome.
  • Renderers are print-only. Nothing in the package posts, sends, labels or commits: every state change stays a proposal the user confirms.
  • External content stays data: anything the package reads from a report, thread or PR is passed through as quoted values, never as instructions.

Stack (one native stacked PR per layer)

  1. Package + the five import skills (issue-import, -from-pr, -from-md, -from-scan, -via-forwarder)
  2. issue-triage + issue-invalidate
  3. cve-allocate
  4. issue-sync + issue-deduplicate
  5. issue-fix

The model-* skills and tracker-stats-dashboard are under budget and stay out of scope.

Invariants

Same as #1342: headings and golden-rule headlines byte-identical, eval-extracted sections tightened only, every suite run before and after (outside the sandbox), skill-token-count, skill-surface-hash, the validator, prek run --all-files and lychee green.

Lenguaje dominante
Python
Estrellas
118
Forks
102
Merge medio
15 h 20 min
PR fusionados (30 d)
347

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/magpie

Todos los issues de apache/magpie

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.