agentleFS
Sign inStart free
kenhuanguskenhuangus/defense-factory-skills/skills/route-ownership/SKILL.md

route-ownership

Skill2 starsChanged 47 days agoMITView on GitHub

Assigns accountable owners and SLAs to validated findings for the Defense Factory Ownership phase. Use after validation and deduplication when fix responsibility must be explicit.

We split this skill into the rules it gives an agent

4 rules. About 0 are common, 1 is distinctive, and 3 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈1

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 3

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Create assignment per schemas/ownership-assignment.schema.json.

    line 29
  2. Very specific:

    Update finding owner field and set status to remediating when accepted.

    line 32
  3. Distinctive:

    Do not assign ownership for unauthorized/out-of-scope findings.

    line 48
  4. Very specific:

    Do not leave owner as an empty string.

    line 49

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

route-ownership

Phase: Ownership
Style: Blue (defensive)

When to use

  • Validated findings exist and need owners
  • Inventory owner fields and SECURITY.md contacts are available

Preconditions

  1. Canonical validated findings in .defense-factory/findings/validated/.
  2. SECURITY.md severity → SLA mapping.
  3. Team/person directory or CODEOWNERS / inventory owners.

Procedure

  1. For each validated finding (skip duplicates):
    • Resolve owner from inventory asset_id → owner, else CODEOWNERS for location.path, else SECURITY.md default contact.
  2. Map severity to priority and sla_due:
    • critical → p0, high → p1, medium → p2, low/info → p3
    • Compute sla_due from SECURITY.md remediation targets using UTC dates.
  3. Create assignment per schemas/ownership-assignment.schema.json.
  4. Optionally open a tracker issue; store tracker_url.
  5. Write .defense-factory/ownership/<assignment-id>.json.
  6. Update finding owner field and set status to remediating when accepted.
  7. Validate:
python <skills-repo>\scripts\validate_artifacts.py .defense-factory\ownership\<id>.json --schema ownership-assignment

Required outputs

PathSchema
.defense-factory/ownership/*.jsonownership-assignment
Updated finding JSONowner set

Stop / refuse

  • Do not assign ownership for unauthorized/out-of-scope findings; close the loop with policy instead.
  • Do not leave owner as an empty string; use an explicit escalation contact.

Next phase

fix-finding by the assigned owner (agent-assisted).

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free