Branch: refs/heads/cvss-source-mandate Home: https://github.com/xwiki/xwiki-dev-llm Commit: 9f7fe5965819236a6e3b1cbc626fb05b05c75cea https://github.com/xwiki/xwiki-dev-llm/commit/9f7fe5965819236a6e3b1cbc626fb0... Author: Vincent Massol <[email protected]> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Take every CVSS metric from the security policy instead of scoring from memory The scoring section listed a subset of the policy's rules and only asked for a re-read "when the exact scoring matters", which is weak enough that a score can be computed from generic CVSS instinct and still look policy-compliant. * Make reading the policy's "Best practices for computing CVSS" section mandatory before setting a vector, and link that section's anchor directly rather than the page. * Carry the rules that were missing and that generic instinct gets wrong: Attack Vector is always Network; XSS fixes the subsequent-system impacts (C/I Low, A None) as well as the vulnerable-system ones, so high subsequent impact asserts code execution and has to be established; the Script-right caveat drops all impacts to Low and is about the right the attack needs, not the one it yields; Attack Complexity, Attack Requirements and User Interaction have no XWiki best practice, and viewing a page is passive interaction. * Reword the verify recipe to say the values must not be scored from, replacing the softer "do not quote as gospel", and fold the calculator sentence into the new lead-in. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Commit: bf0366f3bd41fc3e90ff45c0572a5c2809b07f8e https://github.com/xwiki/xwiki-dev-llm/commit/bf0366f3bd41fc3e90ff45c0572a5c... Author: Vincent Massol <[email protected]> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- [Misc] Point CVSS scoring at the policy section instead of caching its values * Keep the mandate and the anchored link to "Best practices for computing CVSS", but hold no per-metric values in the OKF file: the verify: block says not to score from the file, so caching the values it forbids scoring from is pure liability. * What stays is XWiki's interpretation - the rights-to-Privileges-Required mapping - and the traps: subsequent-system impact asserts code execution rather than XSS, the right-required caveat is about the right the attack needs and not the one it yields, viewing a page is passive interaction. * Drop the same cached values from xwiki-security-advisory Step 2, which fetches that section live anyway. The two copies had already diverged: the skill carried SSRF, the OKF file did not. * Trim the okf/index.md entry back to routing - the imperative belongs in the file, not the map - and restore the (volatile; verify) marker the corpus uses to flag a volatile fact. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Compare: https://github.com/xwiki/xwiki-dev-llm/compare/b3bef903edde...bf0366f3bd41 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications