Skill 安全补丁响应器（CISO 安全运营标准）

执行角色：CISO-001 安全运营 版本：v1.0.0 来源：ai-skill-maintainer §CVE紧急通道 + §emergency-isolate + §dependency-audit 合规：CVE 响应 SLA + 授权验证

核心原则

1. 安全优先：安全补丁不受正常发布周期限制
2. 授权强制：仅 CISO-001/CTO-001 可触发紧急操作
3. SLA 硬约束：CVSS ≥ 9.0 必须 24 小时内响应
4. 最小暴露：隔离期间最小化功能影响

Inter-Agent 接口层

接口身份

TASK 消息格式

{
  "skill": "skill-security-patcher",
  "version": "1.0.0",
  "task": "<task-type>",
  "params": { ... },
  "context": {
    "caller": "<caller-agent-id>",
    "priority": "<P0|P1|P2|P3>",
    "emergency": false,
    "isolated": true
  }
}

可用 Task 类型

Task 详细规格

Task: security-patch

CVE 紧急通道 SLA：

参数 Schema：

{
  "skill-name":     "string (required, skill slug)",
  "cve-id":         "string (required, e.g. CVE-YYYY-NNNNN)",
  "cvss-score":     "number (required, 0.0-10.0)",
  "authorization":  "string (required, must be CISO-001)",
  "caller":         "string (required, agent ID)",
  "changes": {
    "description":  "string (what was changed)",
    "files":        "string[] (list of modified files)",
    "test-results": "string (test outcome summary)"
  }
}

安全红线：

• skill-name 参数仅接受 [a-z0-9-] 字符，拒绝斜杠/点号（防止路径注入）
• authorization 字段仅接受 CISO-001 签名的安全任务
• 所有 agent 调用必须在 isolated 会话中运行

返回值示例：

{
  "status": "success",
  "result": {
    "fixed": true,
    "new-version": "v1.2.1",
    "notification-sent": true,
    "sla-status": "RESOLVED"
  },
  "meta": {
    "reviewer": "CISO-001",
    "duration-ms": 3600000,
    "cve-resolved": "CVE-2026-12345",
    "sla-status": "WITHIN_SLA"
  }
}

Task: emergency-isolate

触发条件：发现 Critical CVE（CVSS ≥ 9.0）或 0-day 漏洞

授权验证伪代码：

authorized = params["caller"] in {"CISO-001", "CTO-001"}
has_reason = len(params["reason"]) > 10
if not authorized:
    raise PermissionError("Only CISO-001 or CTO-001 can trigger emergency isolate")
if not has_reason:
    raise ValueError("Emergency isolate requires documented reason (≥10 chars)")

参数 Schema：

{
  "skill-name": "string (required)",
  "reason":     "string (required, CVE ID or incident description, ≥10 chars)",
  "caller":     "string (required, must be CISO-001 or CTO-001)"
}

返回值示例：

{
  "status": "success",
  "result": {
    "isolated": true,
    "affected-versions": ["v1.0.0", "v1.1.0"],
    "isolation-time": "2026-04-14T00:00:00+08:00",
    "estimated-recovery": "2026-04-15T00:00:00+08:00"
  }
}

解除 emergency-isolate 条件：

1. CVE 已修复（CVSS < 7.0）
2. CISO-001 安全复审通过
3. CQO-001 质量验收通过
4. CTO-001 书面授权解除隔离

Task: health-check

参数 Schema：

{
  "skill-name": "string (required)"
}

健康阈值：TSR < 92% → UNHEALTHY；P95 > 1200ms → DEGRADED；CVSS ≥ 7.0 → HIGH_RISK

返回值示例：

{
  "status": "success",
  "result": {
    "skill-name": "pdf-processor",
    "metrics": {
      "tsr": 94.2,
      "p95-latency-ms": 850,
      "cvss-score": 3.8
    },
    "status": "HEALTHY",
    "recommendations": []
  }
}

Task: dependency-audit

参数 Schema：

{
  "skill-name": "string (required)"
}

返回值示例：

{
  "status": "success",
  "result": {
    "dependencies": [
      {"name": "requests", "version": "2.28.0", "latest": "2.32.0"}
    ],
    "cves": [
      {"id": "CVE-2024-XXXX", "severity": "critical", "fix": "upgrade to 2.32.0+"}
    ]
  }
}

Agent 间调用示例

# CISO-001 请求 CVE 紧急修复
sessions_send(sessionKey="ciso-isolated", message="
skill: skill-security-patcher
task: security-patch
params:
  skill-name: pdf-processor
  cve-id: CVE-2026-12345
  cvss-score: 9.1
  authorization: CISO-001
  caller: CISO-001
  changes:
    description: Fixed command injection via path parameter
    files: [scripts/process.py]
    test-results: All regression tests pass
emergency: true
")

# CTO-001 请求紧急隔离
sessions_send(sessionKey="cto-isolated", message="
skill: skill-security-patcher
task: emergency-isolate
params:
  skill-name: pdf-processor
  reason: CVE-2026-99999 critical remote code execution vulnerability discovered
  caller: CTO-001
")

# CQO-001 请求健康检查
sessions_send(sessionKey="cqo-isolated", message="
skill: skill-security-patcher
task: health-check
params:
  skill-name: pdf-processor
")

CVE 扫描频率矩阵

漏洞响应 SLA 矩阵

错误码参考

版本历史