SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsarkweb-security-patch-intake

arkweb-security-patch-intake

Security & auditing

View repository

Updated 10-15 16:44

About this skill

ArkWeb Vulnerability Intake

For arkweb-security-patch-issue-analyzer。

When to use this skill

Use this skill to parse local Chromium issue HTML/MHTML archives, issue links, CVE/security advisory text, Gerrit CLs, PRs, or commit messages into auditable issue analysis artifacts.

Input

  • context.requirements issue / CVE / Chromium bug / Gerrit CL / PR / security advisory links.
  • Existing .ace-outputs/{runId} report or .ace-outputs/{runId}/{issue_id}/ directory.
  • Local issue HTML/MHTML archive directory, specified by context.requirements ; if unspecified, the default input directory given by the current workflow may be used.

Output

Write to a separate directory for each issue:

  • .ace-outputs/{runId}/{issue_id}/01_issue_analysis.md
  • .ace-outputs/{runId}/{issue_id}/01_issue_analysis.json

If processing multiple issues at once, they must be split into multiple {issue_id} directories starting from this stage. No files may be written to the root directory; do not generate 01_issue_analysis.index.md/json, and do not generate a root-level 01_issue_analysis.md/json。

Detailed output structure is in references/issue-analysis-output.md.

Field ownership boundaries:

  • This stage must fill in: Issue basic fields, original description, upstream fix PR/CL links, fix event audit, preliminary issue/fix summary.
  • This stage must not fill in final values: modified file list, patch local paths, ArkWeb affected/unaffected conclusion, responsibility area, feature tree impact, whether retention is recommended.

Fix link extraction

Use semantic review of issue comments. Do not just regex all URLs. The extraction and deduplication rules are in references/fix-link-extraction.md.

Scripts

Prefer using built-in scripts to parse local HTML/MHTML archives; do not regenerate temporary Python scripts at runtime:

python3 skills/arkweb-security-patch-intake/scripts/parse_local_issue_archive.py \
  --archive-dir <local_issue_archive_dir> \
  --project-root <context.codebase> \
  --output-root <context.projectRoot>/.ace-outputs/<runId>

Script capabilities:

  • Read-only scan .html、.htm、.mhtml、.mht, and can read similar files from issue.zip into a temporary area of the output directory;
  • Force the output directory to be only <context.projectRoot>/.ace-outputs/<runId>, and cannot write to ~/.aceharness/runs/<runId>/outputs/.ace-outputs；context.projectRoot is the workflow output root, the real ArkWeb source root uses context.codebase；
  • Extract the HTML body from MHTML and generate, in each issue's separate directory, the 01_issue_analysis.md/json；
  • Audit code links according to fix-link rules, distinguishing accepted fix, bug-introducing candidate, and ordinary noise links;
  • Write artifacts only to the {issue_id} subdirectory, and output a batch summary to stdout, making it easier for the agent to perform manual review and supplementation.

If the script output upstream_fix_prs[] is empty or there are many decision=review , the agent should perform semantic review based on the original archive and audit table; do not treat the script as the sole source of final judgment.

Rules

  • Do not fabricate CVEs, commits, or file paths.
  • Annotate each key conclusion with a source link or source text.
  • When external network access is unavailable, clearly state the blocking reason and suggested manual supplementation items.
  • Local HTML/MHTML original files are read-only; do not modify the archive directory.
  • Responsibility area and feature tree are read only as background at this stage; do not make final attribution determinations at this stage.