[alangou]

Summary

Security reports use inconsistent formats, making reviewers reconstruct deployment prerequisites, tested versions, and supporting evidence. Add an internal create-security-advisory skill and reusable report template so contributors can prepare clear reports and create authorized private GHSA drafts.

Related Issue

Closes #4871

Changes

• Provide a concise report template covering impact, tested versions, attacker access, reproduction, and evidence. Root cause, CVSS/CWE, and remediation details are optional.
• Distinguish reproduced results, code inspection, and unverified claims; keep tested revisions separate from confirmed affected releases.
• Document duplicate checks, private GitHub draft creation, and read-back verification. Filled reports and payloads stay outside the checkout.
• Teach review-security-issue to retrieve GHSAs and use the report fields; update the contributor inventory and skill maintenance map.

Testing

• Skill validator passed for the new skill and the updated security review skill.
• Markdownlint 0.22.0 passed for all six changed Markdown files using repository rules; the advisory description fragment is exempt from the first-level heading requirement.
• Validated 27 unique skill names, contributor inventory entries, internal metadata, and five relative links.
• npx -y skills add . --list in a disposable copy exposed only the four public skills, preserving internal-skill filtering.
• git diff --check passed.

Rust, SDK, and E2E suites are not applicable to these guidance and template changes. GitHub advisory creation was not exercised against a live repository.

Checklist

• Follows Conventional Commits.
• Commit is signed off for DCO.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.