SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsarkweb-security-patch-report

arkweb-security-patch-report

Security & auditing

View repository

Updated 10-16 07:28

About this skill

ArkWeb Final Report

Used for arkweb-security-patch-report-writer。

When to use this skill

Use this skill in either report state of:

  • ArkWeb 本地 Issue 分析归档与上游安全补丁自动合入

Input

This skill supports two report modes within the same integrated workflow. The report mode must first be determined based on the current state task or existing artifacts, and the requirements must not be mixed.

Mode A: Analysis Archive State

Only summarize local issue parsing, patch fetching, impact determination, and archive artifacts:

  • The input issue archive directory given in the requirement description
  • In the current issue directory, the 01_issue_analysis.*、02_patch_fetch.*、03_impact_decision.*、04_final_archive.md/json、summary.* and patches/

This mode does not yet include automatic merge, conflict resolution, code review, compilation verification, compilation fixes, risk assessment, commit/push to repository, or GitCode PR. The report must not describe "not automatically merged", "not compiled or tested", or "not committed/pushed to repository" as final incomplete items, failure reasons, risks, or gaps; these belong to subsequent states of this workflow.

Mode B: Result Archive State

Summarize existing archive inputs and subsequent merge/verification/commit artifacts:

  • In the input archive directory, the 01_issue_analysis.*、02_patch_fetch.*、03_impact_decision.*、04_final_archive.md/json and patches/
  • Current run artifacts 06_merge_result.md、07_conflict_resolution.md、08_code_review.md、09_build_verification.md、10_build_fix.md、11_risk_assessment.md、12_submit_result.md
  • In batch mode, additionally summarize 00_batch_plan.md/json、batch_status.md/json、issues/{issue_id}/06_merge_result.md、issues/{issue_id}/09_build_verification.md、issues/{issue_id}/11_risk_assessment.md、issues/{issue_id}/12_submit_result.md

Output

Mode A writes to each issue directory:

  • .ace-outputs/{runId}/{issue_id}/04_final_archive.md
  • .ace-outputs/{runId}/{issue_id}/04_final_archive.json
  • .ace-outputs/{runId}/{issue_id}/summary.md
  • .ace-outputs/{runId}/{issue_id}/summary.json

Mode A may first use the built-in summary script to collect existing artifacts, avoiding the generation of temporary summary scripts at runtime:

python3 skills/arkweb-security-patch-report/scripts/collect_archive_summary.py \
  --project-root <context.codebase> \
  --output-root <context.projectRoot>/.ace-outputs/<runId>

This script only reads existing JSON from the 01/02/03 stage and outputs a summary to stdout. It does not write files to the run root directory, and does not regenerate vulnerability facts, patch file lists, or impact conclusions; the agent still needs to write each issue's 04_final_archive.* and summary.*。

A verified archive generation script may also be used to directly write the final report for each issue:

python3 skills/arkweb-security-patch-report/scripts/generate_final_archive.py \
  --project-root <context.codebase> \
  --output-root <context.projectRoot>/.ace-outputs/<runId> \
  --issue-archive-root <local_issue_archive_dir>

This script only writes the <context.projectRoot>/.ace-outputs/<runId>/{issue_id} under the subdirectory 04_final_archive.md/json and summary.md/json, and must not write files to the run root directory, nor to ~/.aceharness/runs/<runId>/outputs/.ace-outputs; the source root uses context.codebase。

Mode B writes to the run root directory:

  • .ace-outputs/{runId}/13_final_report.md
  • Optional .ace-outputs/{runId}/13_final_report.json

Batch mode must also write:

  • .ace-outputs/{runId}/issues/{issue_id}/13_final_report.md
  • Optional .ace-outputs/{runId}/13_batch_summary.json

Must include:

Mode A must include:

  1. Local issue archive directory, actually processed HTML/MHTML files, issue id, and title.
  2. Vulnerability/defect summary, credibility, upstream fix PR/CL.
  3. Patch fetch results, patch file validity, modified file list, and missing artifacts.
  4. Chromium upstream affected version conclusion and basis.
  5. Current context.codebase project impact conclusion, source evidence, responsibility area, affected features, five properties/RAM/ROM, whether retention is recommended, and whether testing is needed.
  6. Security-specific impact summary for security-related issues.
  7. Manual verification suggestions and follow-up work suggestions. Only "If merge/compilation/commit is needed, please enter the automatic merge workflow" may be written; it must not be written as a failure or incompletion of this workflow.
  8. JSON summary block.

Mode B must include:

  1. Input archive directory, issue id, upstream fix PR/CL, patch files, and allowed modified file list.
  2. Automatic merge results, conflict resolution results, final changed files.
  3. Code review conclusion.
  4. Compilation verification and compilation fix results.
  5. Risk assessment summary.
  6. Commit / push-to-repository results, commit id, fork branch, GitCode PR link, or failure reason.
  7. Unresolved issues, follow-up suggestions, rollback suggestions.
  8. JSON summary block.

Mode B batch input must also include:

  1. Batch input run directory, total issue count, ready/blocked/submitted/failed statistics.
  2. One summary line per issue: issue_id, CVE, impact determination, target sub-repository, duplicate_files/overlap, commit, fork branch, GitCode Issue, PR, start build comment result, final status.
  3. duplicate_files/overlap file list; must list the associated issue, winner_issue_id, and loser issue for each duplicate file group. The winner issue is archived according to the normal active batch result; loser issues that involve duplicate files but did not enter the active batch must be listed as "legacy issues", explaining the duplicate files, associated issue, winner_issue_id, reason for not being automatically merged, and follow-up manual handling suggestions; if there is blocked_overlap_conflict, list it as a manual handling item.
  4. Confirmation of an independent commit/PR for each issue; the submission results of multiple issues must not be merged into a single "batch submission" description.
  5. List successful issues and failed issues separately; failed issues must retain the failure stage, failure reason, and next-step suggestions.

Field ownership boundaries:

  • This stage only aggregates and archives; it does not regenerate vulnerability facts, patch file lists, or impact conclusions.
  • Must faithfully reference existing artifacts of the current workflow; must not fabricate unexecuted results.
  • Mode A must not require or summarize automatic merge, compilation verification, or submission-to-repository results; these belong to subsequent states of this integration workflow.
  • Mode B must reference the preceding merge, compilation, risk, and submission artifacts; if missing, handle them as missing items of the automatic merge workflow.
  • In Mode B batch input, the root report is an overview and must not replace the independent report for each issue; each issue's GitCode submission, PR, and gate status must be presented independently.
  • Must not regenerate local issue analysis archive artifacts; must not write 01_issue_analysis.*、02_patch_fetch.*、03_impact_decision.*、04_final_archive.*、summary.* or patches/。
  • If the input archive directory lacks a certain stage's artifacts or patch files, list the missing items in the final report.