[PR] feat(skills): add report-framework-issue skill [magpie]

["choo121600 (via GitHub)" <gi...@apache.org>]

choo121600 opened a new pull request, #922:
URL: https://github.com/apache/magpie/pull/922

   <!-- SPDX-License-Identifier: Apache-2.0
        https://www.apache.org/licenses/LICENSE-2.0 -->
   
   ## Summary
   
   <!--
   1-3 bullets: what changed and why. The "why" is what reviewers care
   about most — a one-line summary of the motivation beats a paragraph
   restating the diff.
   -->
   
    - Add `report-framework-issue`, an always-on (utilities / Meta) skill that turns a
      problem an adopter hits **while using Magpie itself** into a redacted GitHub issue
      on `apache/magpie` — the report-an-issue complement to `setup-upstream-fix` (fix PR).
    - Why redaction: adopters run the framework against pre-disclosure CVE content on a private
      tracker, so a bare `gh issue create` risks leaking tracker / embargoed-CVE /
      private-list / cross-project content to a public repo. The load-bearing step is a
      **mandatory public-disclosure scrub** (8 categories) plus a `safe_to_file` gate that
      refuses to file reports whose essence is inherently confidential.
   
   ## Type of change
   
   <!-- Tick all that apply. -->
   
   - [x] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [ ] Tool / bridge contract (`tools/<system>/*.md`)
   - [ ] Python package (`tools/*/` with `pyproject.toml`)
   - [ ] Groovy reference impl
   - [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
   - [x] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   - [ ] Project template (`projects/_template/`)
   - [ ] CI / dev loop (`prek`, workflows, validators)
   - [ ] Other:
   
   ## Test plan
   
   <!--
   How you verified the change. Be specific. The reviewer reads this to
   decide what to spot-check vs trust. Empty "ran the tests" doesn't help.
   -->
   
   - [x] `prek run --all-files` passes
   - [ ] For Python packages touched: `uv run pytest` / `ruff check` / `mypy` passes
   - [ ] For Groovy bridges touched: command-line invocation tested end-to-end
   - [x] For skill changes: eval suite passes for the affected skill
         (`PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/`)
   - [x] For skill *behaviour* changes: a new or updated eval fixture is included in this PR
         (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
   - [ ] Other:
   
   ## RFC-AI-0004 compliance
   
   <!--
   Tick the principles the change touches. Skip rows that don't apply.
   RFC-AI-0004 is the framework's constitution — see
   docs/rfcs/RFC-AI-0004.md.
   -->
   
   - [x] **HITL** — any new mutation is gated on explicit user confirmation
   - [x] **Sandbox** — no new unrestricted host access; network reach declared in the adapter
   - [x] **Vendor neutrality** — placeholders (`<PROJECT>`, `<tracker>`, `<upstream>`, `<security-list>`) used in all skill / tool prose (the `check-placeholders` prek hook is the mechanical gate)
   - [x] **Conversational + correctable** — agentic-override path documented if behaviour is adopter-tunable
   - [x] **Write-access discipline** — no autonomous outbound messages; drafts only, sent on confirmation
   - [x] **Privacy LLM** — private content does not reach a non-approved LLM; redactor invoked where needed
   
   ## Linked issues
   
   <!-- e.g. Closes #NNN, Refs #NNN. List every related issue. -->
   
   ## Notes for reviewers (optional)
   
   <!--
   Anything specific you want the reviewer to look at. Areas of uncertainty.
   Trade-offs you considered and rejected. Decisions that the agent and you
   disagreed on during the authoring loop.
   -->
   
    - **One concern.** The skill can't ship without its eval suite (project rule: a skill PR
      without a matching eval suite is incomplete) or its catalog registration (validator checks
      modes.md / labels / vendor-neutrality consistency), so those live here, not in split PRs.
    - **Security-sensitive surface worth extra eyes:** Step 2's 8-category scrub cascade and the
      `safe_to_file: false` → route-privately behaviour — they enforce the AGENTS.md confidentiality
      rules on a *public* destination.
    - Footprint: 1 `SKILL.md` + 18 tiny eval fixtures + 3 catalog edits + 1 regenerated score doc + 3 symlinks.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(skills): add report-framework-issue skill [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #922:
URL: https://github.com/apache/magpie/pull/922


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(skills): add report-framework-issue skill [magpie]

["choo121600 (via GitHub)" <gi...@apache.org>]

choo121600 commented on PR #922:
URL: https://github.com/apache/magpie/pull/922#issuecomment-5072293871

   I used this skill to create issue #923 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org