Add Chrome Releases blog integration to security-audit skill#4097
Merged
Conversation
Integrate the Chrome Releases blog (chromereleases.googleblog.com) as an additional data source for the security-audit skill. This provides: - Earlier detection of Skia/ANGLE CVEs (blog publishes before NVD) - Explicit component tagging (Skia, ANGLE, Canvas, GPU, Fonts) - Direct milestone-to-CVE mapping from Chrome version numbers - Cross-validation of NVD findings Uses a two-pass approach for robustness: - Pass 1: Deterministic regex extraction from the known blog format - Pass 2: Raw text included for AI review (catches format changes) New files: - scripts/query-chrome-releases.py: RSS fetcher with keyword filtering, regex CVE extraction, and caching (no external dependencies) - references/chrome-releases.md: Reference doc for AI review instructions Updated files: - SKILL.md: Added Step 1.5 (Chrome Releases query), renumbered steps - references/skia-cve-resolution.md: Cross-reference instructions - references/third-party-deps.md: ANGLE coverage note - references/report-schema.md: chromeReleases section + source field Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Renders the chromeReleases data in a new card section with: - Severity breakdown cards (Critical/High/Medium/Low + above-milestone count) - CVE table grouped by component (only shows CVEs above current milestone) - Meta line with query stats (months, posts, totals) - Badge in header showing relevant CVE count Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Each CVE row now has a 'Blog' column with a link icon pointing to the Chrome Releases blog post where it was disclosed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Component priority order: Skia > ANGLE > Canvas > Fonts > GPU > Compositing > WebGL > others. Within same priority, sort by severity. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Each top card now shows a small description below the label: - Needs Attention: 'CVEs requiring action or patches' - CG Alerts: 'Build pipeline container vulnerabilities' - Undiscovered: 'Proactively found, no issue filed yet' - False Positive: 'Not applicable to SkiaSharp' - Clean: 'Dependencies with no open CVEs' Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- CVE IDs and severity now use white-space:nowrap to prevent wrapping - Descriptions truncated to 60 chars with '…' indicator - Click description to expand a hidden row with full text - Chevron icon hints at expandability - Keeps table compact and scannable Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Table uses table-layout:fixed so columns respect widths - CVE, Severity, CVSS, Fixed In, Status get fixed narrow widths - Description gets all remaining space with text-overflow:ellipsis - Click row to expand full description below - No more wrapping on CVE IDs or severity text Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…me CVE tables Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Skia CVEs: maps fixMilestone -> fixedIn for display - Non-Skia deps: hides the 'Fixed In' column entirely when no data - Avoids showing a blank column that wastes space Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sort order: potentially_affected/affected > undiscovered > already_fixed > false_positive. Within each group, Critical > High > Medium > Low. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
New script: render-security-audit-md.py generates a comprehensive MD report from the JSON, including all sections: - Summary table with status counts - Chrome Releases blog (CVEs above milestone, by-component breakdown) - Findings sorted by assessment priority, then severity - CG alerts with Critical/High detail table - Version verification table - Next steps with commands Updated SKILL.md to reference new script and update Step 10 to render both HTML + MD. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The render-security-audit-md.py script now produces the full MD report automatically. Step 11 no longer asks the AI to manually compose a markdown summary — just point to the 3 generated files and highlight top actionable items. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The markdown report is primarily for AI consumption, so full descriptions are needed for proper analysis. Removed 80-char truncation from both CVE tables and Non-Chrome CVE tables. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Added sanitize_cell() to replace newlines with spaces and escape pipe characters in descriptions — fixes broken table rendering - Moved Chrome Releases section after CG Alerts (order: Summary → Findings → CG → Chrome Releases → Version Verification → Next Steps) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The JSON uses 'name' not 'dependency' for version verification entries. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
📦 Try the packages from this PRWarning Do not run these scripts without first reviewing the code in this PR. Step 1 — Download the packages bash / macOS / Linux: curl -fsSL https://raw.githubusercontent.com/mono/SkiaSharp/main/scripts/get-skiasharp-pr.sh | bash -s -- 4097PowerShell / Windows: iex "& { $(irm https://raw.githubusercontent.com/mono/SkiaSharp/main/scripts/get-skiasharp-pr.ps1) } 4097"Step 2 — Add the local NuGet source dotnet nuget add source ~/.skiasharp/hives/pr-4097/packages --name skiasharp-pr-4097More options
Or download manually from Azure Pipelines — look for the Remove the source when you're done: dotnet nuget remove source skiasharp-pr-4097 |
B1: Fix field-name contradiction between schema, docs, and renderers.
- report-schema.md now documents structuredCves as primary array
- security-audit-schema.json requires structuredCves (not earlyDisclosures)
- Added snake_case→camelCase field mapping docs
- Added blogPostUrl propagation instructions
B2: Add chromeReleases as explicit key #6 in SKILL.md Step 8 with
transformation instructions so the AI knows to emit it.
N1: MD renderer now shows resolution details (fixCommit, reachability,
inOurTree, cherryPicksCleanly) when present on CVEs.
N2: MD header now includes upstream commit, verification note, and
behind-by count when available.
N3: Cache freshness check now compares months_queried — requesting a
wider window than cached invalidates the cache automatically.
N4: CVE_ENTRY_REGEX reporter/date tail is now optional, capturing
embargoed entries that omit attribution.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
📖 Documentation Preview The documentation for this PR has been deployed and is available at: 🔗 View Staging Site This preview will be updated automatically when you push new commits to this PR. This comment is automatically updated by the documentation staging workflow. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integrates the Chrome Releases blog as a data source for the security-audit skill, providing early CVE detection (often before NVD) and cross-validation with existing NVD data. Also adds a Markdown report renderer and numerous HTML viewer improvements.
New Features
Chrome Releases Blog Integration
query-chrome-releases.py— Fetches RSS feed, extracts Skia-relevant CVEs (regex-based), caches results for 24hsourcefield:"both","chrome_releases", or"nvd")references/chrome-releases.mdMarkdown Report Renderer
render-security-audit-md.py— Generates comprehensive markdown from JSON for AI consumptionHTML Viewer Improvements
Eval Updates
Workflow Changes
Files Changed
scripts/query-chrome-releases.py,scripts/render-security-audit-md.pyreferences/chrome-releases.mdscripts/viewer.htmlSKILL.mdevals/evals.json