vuln-disclosure

Vulnerability Disclosure

Publish a reviewed security advisory through a configured provider without pretending an attempted publication succeeded. The default prepares the exact payload, gates the live publication, and requires independent readback; vuln-disclosure remains the explicit preparation runner and publish accepts its typed packet in composed use. Where cve-audit proves exact vulnerability identities and vuln-triage decides exposure, remediation, and wording, this skill checks whether one exact advisory is ready to enter a consequential provider lane.

Disclosure deserves a distinct boundary because a technically correct finding can still be premature, unsafe, mistargeted, or unhelpful to affected users. Embargo, remediation availability, channel, audience, and disclosure authority must all be visible before publication approval is requested.

How it works

1. Admit one validated vuln-triage advisory packet and preserve its evidence binding and exact advisory ids.
2. Review the specified channel, target, embargo posture, remediation context, and disclosure checklist.
3. Decide hold or ready_for_publication_approval. The review may not add or omit affected advisory ids or silently rewrite the payload.
4. Deterministically package a digest-bound outbox packet for the named target.
5. The default runner stops with publication_status: not_published and provider_status: not_called.
6. publish recomputes the payload digest, requests approval for that exact packet, invokes advisory.publish under one idempotency key, and then calls advisory.read. The returned advisory ref and payload digest must match.

Safe review and packaging need no human approval because they remain local. The native provider lane owns the human gate, idempotency, configured binding, publication request, and stable readback. No provider token or HTTP client lives in this package. Until the independent read succeeds, no receipt may describe the advisory as live.