security-feedback

Security Feedback

A maintainer commented on a security-labelled issue — almost always a per-run security scan summary (one issue per scan, a task-list of findings). Based on the comment, either:

• Break selected findings into individual issues (each can later feed build). Primary flow.
• Record a suppression in SECURITY.md (accepted risk / false positive).
• Reply for discussion, or ignore noise.

The parent issue's grammar is the contract defined in skills/security-review/references/issue-format.md. This skill is staged into its own workspace and cannot read that file, so it carries its own copy of the row/severity regex below — if you change the grammar, update both in lockstep.

Context

• context.repo — owner/name
• context.issueNumber — the security summary issue (parent)
• context.commentBody — the triggering comment
• context.sender — the commenter's GitHub login

The parent body is not passed — fetch it at step 1.

1. Fetch and parse the parent issue

github_get_issue({ owner, repo, issue_number: issueNumber }).

Version check. The body MUST start with <!-- lastlight-security-scan-version: 1 -->. If the marker is missing or the version isn't 1, reply: "Unknown scan-summary format — this skill is at version 1 but the parent reports a different version. Ask the maintainer to re-run @last-light security-review." Do not parse further.

Parse each finding row with this canonical regex (all three states):

/^- \[([ x])\] <!-- item:(\d+) fp:([0-9a-f]{8,}) --> (?:~~)?\*\*(.+?)\*\* — `([^`]+):(\d+)` \(([a-z][a-z0-9-]*) · `([^`]+)`\)(?:~~ → #(\d+))?$/m

Captures: checkbox ( /x), item, fp, title, file, line, tool, rule, and subIssueNumber (only when already broken out). Derive per row:

Derived	Definition
alreadyBrokenOut	subIssueNumber != null — turned into a sub-issue on a prior run
userTicked	checkbox === "x" && !alreadyBrokenOut — the maintainer ticked the box, selecting it