security-advisory: the GHSA draft-card title copies the advisory summary onto the board

[cliffhall]

Summary

The security-advisory draft-card title template, [GHSA-xxxx-yyyy-zzzz] - <advisory summary>, contradicts the rule stated a few lines below it in the same skill: do not copy the vulnerability description onto the card, because project access and advisory access are separate permission sets, so the board's audience is wider than the advisory's.

An advisory summary routinely names the vulnerable component and the attack class ("SSRF in the proxy's …"). Putting it in the title puts exactly that detail in front of everyone with board access, including people who are not advisory collaborators. The body rule ("link and triage metadata only") is undone by the title.

Raised by Copilot on the v2.8.0 milestone-merge PR (#2456: r4079443030, r4079443077, r4079443093). Per the release procedure, a finding on the merge PR is fixed on v2/main, not on the merge branch.

Where the template appears

• AGENTS.md (Issue-driven Work Style, the advisory exception): titled [GHSA-xxxx-yyyy-zzzz] - <summary>
• .claude/skills/security-advisory/SKILL.md step 1: **Title:** [GHSA-xxxx-yyyy-zzzz] - <advisory summary>
• .claude/skills/board-ops/SKILL.md: titled [GHSA-xxxx-yyyy-zzzz] - …

Proposed fix

Make the title generic: [GHSA-xxxx-yyyy-zzzz] - Private security advisory, the same in all three places. The [GHSA- prefix, which the board audit's draft carve-out and the board-ops title lookup both key on, is unchanged, so no query changes. The GHSA id plus the advisory link in the body are enough for anyone with advisory access to find the details.

Why not a release blocker

The boards are private to the org (so this is a wider-than-intended internal audience, not a public leak), and none of these files ship in the npm tarball.

Acceptance

• All three templates use a generic title; none asks for the summary
• The security-advisory skill's body rule and title rule agree
• npm run verify:skills passes; re-run skills:eval -- security-advisory if the description changes

[cliffhall]

Triage: Priority Medium (total 6)

• Severity 3 — the documented procedure discloses what its own rule says to withhold (private board, so a wider internal audience rather than a public leak)
• Urgency 2 — wanted eventually; nothing is blocked, and no advisory is mid-flight on it
• Bonuses: +1 security-related

Board: #28, Status Todo, milestone v2.9.0 (filed through the create flow).

[cliffhall]

Closing as not planned. The premise is wrong for this org: anyone with access to board #28 can also see the repo's Security Advisories, so the card title discloses nothing a card reader could not already read. The title template stays as is.