aeon

Vuln Tracker / aeon skill

Track vulnerability disclosures

One lifecycle poll over everything vuln-scanner produces - PR and advisory status, PVR triage transitions, and pending-disclosure aging, with a stars-secured impact headline and one action queue.

CATEGORY Dev & CodeRUNS Daily at 16:30 UTCUPDATED
Skill
Vuln Tracker vuln-tracker
Category
Dev & Code
Default schedule
Daily at 16:30 UTC
cron 30 16 * * *
Last updated

commit 56e25ea
Source
aeonfun/aeon/skills/vuln-tracker/SKILL.md MIT licensed, one prompt file

What it does

Vuln Tracker is an aeon skill: One lifecycle poll over everything vuln-scanner produces - PR and advisory status, PVR triage transitions, and pending-disclosure aging, with a stars-secured impact headline and one action queue. Like every aeon skill it is one SKILL.md prompt file that runs unattended on your own GitHub Actions, on a schedule or when you trigger it, and sends what it finds to Telegram, Discord, Slack or email.

This skill is the daily read/poll arm of the vuln pipeline: vuln-scanner opens PRs, submits PVRs, and queues disclosure drafts, then moves on. This skill polls everything it produced and surfaces what the operator must look at - it does not open PRs or submit advisories itself (those are vuln-scanner's write actions).

Input: the var setting

Every aeon skill takes one optional text input, var, set in aeon.yml or typed in when you run it by hand. It picks the target or the mode for that run.

Scope selector for the lifecycle poll:

  • empty → full lifecycle poll: PR/advisory status + PVR triage + disclosure-queue aging (default).
  • prs (also pr / tracker) → Arm A only - PR/advisory status audit + stars-secured dashboard.
  • pvr → Arm B only - PVR triage-state poll on submitted advisories.
  • queue (also disclosures / backlog) → Arm C only - pending-disclosure queue aging + escalation.
  • a bare GHSA-xxxx-xxxx-xxxx → Arm B, single-advisory mode - check just that one advisory's triage state on demand.

What it needs

Besides the model you connected to aeon, Vuln Tracker uses the following. Add secrets as GitHub Actions secrets on your aeon repo, or in Aeon Connect.

  • GH_TOKEN - optional secret, unlocks more data or features
  • GH_GLOBAL - optional secret, unlocks more data or features

Install and run it

Easiest: open Aeon Connect, sign in with GitHub and turn on Vuln Tracker. No clone, no terminal. To add it to an existing aeon repo from a shell, run:

bin/add-skill aeonfun/aeon vuln-tracker

Then switch it on in aeon.yml (the default schedule is filled in):

skills:
  vuln-tracker: { enabled: true, schedule: "30 16 * * *", var: "" }

New to aeon? Read the docs for how skills, schedules and memory fit together, or browse all skills.

Related skills



RUN NOW