mirror of
https://github.com/andrewyng/openworker.git
synced 2026-09-14 08:04:32 +00:00
Rohit C Prasad
b5b000eb76
Security, Cloud Posture, and Dependency Audit coworkers as self-contained bundle dirs (manifest + skills) driving OSS scanners; registry loads bundle subdirs; packaging includes them.
1.4 KiB
1.4 KiB
name, description
| name | description |
|---|---|
| security-fix-pr | Turn triaged security findings into focused, reviewable fix PRs |
Package security fixes so a busy reviewer can approve them with confidence.
- One PR per theme (e.g. "parameterize SQL in the reports module"), never a mixed security dump. Small diffs get reviewed; big ones get postponed.
- Branch naming:
security/<theme>from the repo's default branch. Follow the repo's existing commit-message style. - Every fix commit carries its test: add or extend one that fails without the fix, in the repo's existing test layout and idiom. If testing a fix isn't practical, say so in the PR body instead of skipping silently.
- PR body structure (keep it tight):
- What was wrong, in plain language, with severity and why it matters HERE (one or two sentences of reachability/impact, not scanner boilerplate).
- What the fix does, and what it deliberately does not change.
- How it was verified (test names, commands run).
- NEVER include secret values, exploit payloads, or step-by-step attack recipes in a public PR — describe the class of issue instead.
- If the GitHub connector is available, open the PR with it; otherwise prepare the branch and hand the user the exact push/PR commands.
- Fixing is yours; MERGING is the team's. Never merge your own security PR — deliver it and summarize what a reviewer should scrutinize.