[alangou]

Summary

Security reports use inconsistent formats, making reviewers reconstruct deployment prerequisites, tested versions, and supporting evidence. Add the required report template and an internal create-security-advisory skill to prepare structured reports and authorized private GHSA drafts.

Related Issue

Closes #4871

Related pull requests

Stacked on #4832: this PR targets docs/security-ghsa/alangou. Merge it into that branch first, then merge #4832 into main to land the policy and skills together.

Changes

• Require the template's core headings and supporting reproduction or code evidence. Root cause, CVSS/CWE, and remediation details remain optional.
• Distinguish reproduced results, code inspection, and unverified claims; keep tested revisions separate from confirmed affected releases.
• Document duplicate checks, private GitHub draft creation, and read-back verification. Filled reports and payloads stay outside the checkout.
• Teach review-security-issue to retrieve GHSAs and request missing structure or evidence before technical triage; update the contributor inventory and skill maintenance map.

Testing

• Skill validator passed for the new skill and the updated security review skill.
• Markdownlint 0.22.0 passed for all seven affected Markdown files across the stack using repository rules; the advisory description fragment is exempt from the first-level heading requirement.
• Validated 27 unique skill names, contributor inventory entries, internal metadata, and nine relative links across the stack.
• npx -y skills add . --list in a disposable copy exposed only the four public skills, preserving internal-skill filtering.
• git diff --check passed; verified that the child PR contains only the six skill-related files.

Rust, SDK, and E2E suites are not applicable to these guidance and template changes. GitHub advisory creation was not exercised against a live repository.

Checklist

• Follows Conventional Commits.
• Commit is signed off for DCO.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[alangou]

/ok to test a264fde