Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Deep split of the security skill family

Chiusa
  • Qualcosa non va?
#1,672 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
12/100
Tipo di issue
Refactoring
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
markdown, python
Ambito
security, tooling

Direzione di ricerca

Start with the per-skill table and the measured_tokens: stamps, then read the SKILL.md files for security-issue-import and security-cve-allocate, plus the new tools/security-management package the plan describes. Done means each skill is under the body budget and 500-line cap, with headings and golden-rule headlines unchanged, and skill-token-count, skill-surface-hash, the validator, prek run --all-files and lychee all passing. This is a multi-PR refactor that needs maintainer design input, so it is not a first contribution.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

capability:fix capability:intake capability:resolve capability:triage contract:change-request contract:cve-authority contract:people contract:security-tracker contract:source-control contract:tracker enhancement family:ci family:docs family:security family:tools kind:perf substrate:analytics substrate:framework-dev substrate:sandbox

Part of #1342: the deep split of the security family, the same pattern as pr-management (#1570–#1585) and release-management (#1604–#1625).

The first pass (#1344) was a wording pass. The family is still the largest: 15 skills, 98,884 body tokens in total, 11 over the body budget and 7 over the 500-line cap.

skill body tokens (budget ≈ 5,850 incl. pre-flight) lines (cap 500)
security-issue-import 9,864 ⚠ 561 ⚠
security-issue-import-from-pr 8,447 ⚠ 659 ⚠
security-issue-invalidate 7,582 ⚠ 519 ⚠
security-cve-allocate 7,366 ⚠ 529 ⚠
security-issue-fix 7,163 ⚠ 494
security-issue-triage 7,130 ⚠ 534 ⚠
security-issue-import-from-md 7,095 ⚠ 523 ⚠
security-issue-sync 6,734 ⚠ 483
security-issue-import-via-forwarder 6,213 ⚠ 350
security-issue-deduplicate 5,989 ⚠ 472
security-issue-import-from-scan 5,964 ⚠ 401
security-model-verify 5,611 422
security-model-update 4,821 348
security-model-prepare 4,673 374
security-tracker-stats-dashboard 4,232 325

Body tokens are the measured_tokens: stamps, which include the frontmatter and the generated pre-flight block (~850 tokens together), so the 5,000-token body budget corresponds to about 5,850.

Approach

  • A new tools/security-management package holds the deterministic rules: classification, field extraction, tracker-body and comment rendering, and the scrub checks. The skills call it and keep only judgement and the confirmation gates.
  • SKILL.md becomes a router; rules that serve one sub-action move into one sibling file per backend or outcome.
  • Renderers are print-only. Nothing in the package posts, sends, labels or commits: every state change stays a proposal the user confirms.
  • External content stays data: anything the package reads from a report, thread or PR is passed through as quoted values, never as instructions.

Stack (one native stacked PR per layer)

  1. Package + the five import skills (issue-import, -from-pr, -from-md, -from-scan, -via-forwarder)
  2. issue-triage + issue-invalidate
  3. cve-allocate
  4. issue-sync + issue-deduplicate
  5. issue-fix

The model-* skills and tracker-stats-dashboard are under budget and stay out of scope.

Invariants

Same as #1342: headings and golden-rule headlines byte-identical, eval-extracted sections tightened only, every suite run before and after (outside the sandbox), skill-token-count, skill-surface-hash, the validator, prek run --all-files and lychee green.

Lingua principale
Python
Stelle
118
Fork
102
Merge medio
14h 28m
PR unite (30g)
365

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/magpie

Tutte le issue di apache/magpie

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.