What problem does it solve? Security disclosure PRs opened by an automated scanner rot silently: merged fixes go uncelebrated, maintainer questions go unanswered, and queued drafts past their disclosure window vanish. This Skill runs a daily sweep that cross-references scan history against live GitHub state so nothing falls through the cracks. ## Core Features & Use Cases - Lifecycle auditing: Cross-references memory/vuln-scanned.json with live GitHub PR state via gh CLI to categorize every disclosure as merged, needs-answer, stale, queued, newly-actionable, and more. - Stars Secured metrics: Aggregates stargazer counts across every repo where fixes landed, are in flight, or are tracked, producing a leaderboard dashboard in memory/topics/vuln-followup.md. - Channel re-probing: Re-checks skipped disclosures to detect when private vulnerability reporting or SECURITY.md becomes available, surfacing newly-actionable items. - Use Case: A maintainer comments on a bot-opened security PR asking for clarification. The next daily run flags it in the operator-action queue and sends a notification with the comment excerpt. ## Quick Start Run the vuln tracker to audit all open security PRs and queued disclosures, then update the follow-up dashboard and notify me of anything needing action.
