skills.rest
apache
apacheOFFICIAL
Explore all skills by this author →
WebsiteGitHub

allocate-cve

Walks tracker issue holders through PMC-gated CVE allocation and updates the tracker with Stripped title and JSON link.

79|76|Updated Apr 28, 2026
Search Tags:#automation#security#cve#allocation#tracker#vulnogram
One-click install
npx skills add https://github.com/apache/airflow-steward --skill allocate-cve
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: allocate-cve
Source: https://github.com/apache/airflow-steward/tree/main/.claude/skills/allocate-cve
Command: npx skills add https://github.com/apache/airflow-steward --skill allocate-cve

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Walk a security team member through allocating a CVE for an <tracker> tracking issue. The tool prints the ASF Vulnogram allocation URL and a CVE-ready title (the issue title stripped of redundant <vendor>: <product>:, [ Security Report ], trailing version parens and similar noise), waits for the allocated CVE ID (allocation is PMC-gated — non-PMC triagers relay to a PMC member), and then updates the tracker in place: fills in the CVE tool link field, adds the cve allocated label, posts a collapsed status-change comment, and runs generate-cve-json --attach to embed the paste-ready JSON in the body. Finishes by handing off to the sync-security-issue skill to reconcile the rest of the tracker (milestone, assignee, reporter drafts, fix-PR state) now that the CVE landing is complete.

Core Features & Use Cases

  • Walks a security team member through the CVE-allocation flow, producing a clickable allocation URL and a ready-to-use title.
  • Enforces PMC gating rules and provides a relay path for non-PMC triagers to involve a PMC member.
  • Updates the tracker with the CVE tool link, the cve allocated label, and a rollup status entry; regenerates the CVE JSON attach and hands off to sync-security-issue for full reconciliation.

Quick Start

Invoke the allocate-cve skill on a tracker issue, follow the prompts to fetch the tracker state, generate the stripped CVE title, and await the allocated CVE before proceeding.

Frequently Asked Questions about allocate-cve

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I allocate a CVE for a security tracker issue?▼

To allocate a CVE, this skill reads the tracker state, generates a stripped CVE-ready title, provides the ASF Vulnogram allocation URL, and waits for the assigned CVE ID before updating the tracker.

How does CVE allocation work for non-PMC security triagers?▼

For non-PMC triagers, CVE allocation is PMC-gated and uses a relay flow to route the Vulnogram allocation URL to a PMC member who completes the CVE ID assignment.

What is the process to generate and attach CVE JSON to a tracker?▼

The CVE JSON generation process uses the generate-cve-json --attach command to embed a paste-ready JSON payload directly into the tracker issue body after the CVE ID is assigned.

How do I clean up issue titles for a CVE submission?▼

The skill automatically strips redundant vendor prefixes, security report tags, and trailing version parentheses from the tracker issue title to produce a clean, CVE-ready submission title.

What happens to the security tracker after CVE allocation is complete?▼

After CVE allocation, the skill updates the tracker with the CVE tool link, adds the cve allocated label, posts a status-change comment, and hands off to sync-security-issue for milestone and assignee reconciliation.

Do I need PMC approval to assign a CVE ID to a vulnerability tracker?▼

Yes, CVE ID assignment requires PMC approval by enforcing PMC gating rules, meaning only PMC members can execute the final allocation step while others must relay the request.

Related Skills

Explore More Legal & Compliance Skills→
markus41markus41
18

jira:pr

Create GitHub pull requests linked to Jira issues and transition them to In Review.

Community
Intermediate
apacheapache
79

sync-security-issue

Reconcile a security issue across tracker, GitHub PRs, and reporter thread.

Official
Advanced
apacheapache
79

generate-cve-json

Generate deterministic CVE 5.x JSON records from GitHub tracking issues.

Official
Advanced
apacheapache
79

magpie-security-cve-allocate

Automate CVE allocation and issue tracker updates with governance controls.

Official
Advanced