(magpie) branch main updated: fix(security): remove ASF address from skills (#1055)

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie.git


The following commit(s) were added to refs/heads/main by this push:
     new 3bc786cd fix(security): remove ASF address from skills (#1055)
3bc786cd is described below

commit 3bc786cdef5b33f7fc1ae9570b589a5a2e4dab0b
Author: Polly Labs <po...@gmail.com>
AuthorDate: Sat Aug 1 06:23:42 2026 -0400

    fix(security): remove ASF address from skills (#1055)
---
 skills/security-cve-allocate/SKILL.md         | 12 ++++++------
 skills/security-issue-sync/github-advisory.md |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/skills/security-cve-allocate/SKILL.md b/skills/security-cve-allocate/SKILL.md
index 020eff9e..c52185dc 100644
--- a/skills/security-cve-allocate/SKILL.md
+++ b/skills/security-cve-allocate/SKILL.md
@@ -463,12 +463,12 @@ re-invoke this skill with the CVE ID as an override argument to
 resume from Step 4.
 
 **Fallback when no governance-authorised member is reachable:**
-if every authorised member is unavailable or unresponsive, send
-an email to `security@apache.org` with subject
-`CVE request for <one-line description>`. The ASF Security Team
-will allocate the CVE and send the ID back. Re-invoke this skill
-with the returned `CVE-YYYY-NNNNN` as an override to resume from
-Step 4.
+if every authorised member is unavailable or unresponsive, follow
+the fallback path documented by the active CVE-tool adapter (for
+the Vulnogram adapter, see
+[`tools/cve-tool-vulnogram/allocation.md` § *PMC-gated access*](../../tools/cve-tool-vulnogram/allocation.md#pmc-gated-access)).
+When the fallback returns a `CVE-YYYY-NNNNN`, re-invoke this skill
+with that ID as an override to resume from Step 4.
 
 **Wait for the user** to report back a `CVE-\d{4}-\d+` token. Do
 not proceed to Step 4 until that token has arrived. If the user
diff --git a/skills/security-issue-sync/github-advisory.md b/skills/security-issue-sync/github-advisory.md
index 8c0239d5..c5d50280 100644
--- a/skills/security-issue-sync/github-advisory.md
+++ b/skills/security-issue-sync/github-advisory.md
@@ -126,7 +126,7 @@ path.
 ### Delivery — an email relay (draft, never auto-sent)
 
 Create a **draft** email to the org's advisory-admin security team
-(`<security-team-list>`; for ASF, `security@apache.org`) with
+(`<security-team-list>`) with
 `oauth-draft-create` — never send directly (SKILL Golden rule 1; and the
 Gmail MCP mangles the `security/advisories/GHSA-…` URLs into redirects, so
 use oauth-draft). **Always CC the project `<security-list>`** so the