security-advisory-compat-enforcer

# Security Advisory Compatibility Enforcer Use this skill to translate a GitHub repository security advisory into the smallest safe update to `.github/aw/compat.json`. ## Required inputs Record the repository, GHSA identifier, requested enforcement policy, and any patched version supplied by the user. Treat a user-supplied version as a target to verify, not as evidence for advisory details. ## Evidence retrieval 1. Attempt authenticated retrieval first: `gh api repos/OWNER/REPO/security-advisories/GHSA-ID`. 2. If authentication is unavailable or access fails, try the public global advisory endpoint: `gh api advisories/GHSA-ID` (or its equivalent REST URL). 3. Record the endpoint and outcome of each attempt. If both sources are inaccessible, state that explicitly. Never infer or invent the affected package, vulnerable range, severity, CVE, publication state, or patched version. 4. Verify the proposed patched version independently. Prefer a published repository release or tag, then package-registry metadata when applicable. Cite the exact URL or command result. Do not update compatibility policy if the target cannot be verified, unless the user explicitly directs use of a supplied target despite inaccessible advisory metadata; document that limitation without converting it into fabricated advisory evidence. ## Choose the correct policy field - `minimumVersion` is a hard floor: activation fails for every compiler version below it. Change it...