pi-ghsa

A Pi extension that loads GitHub Security Advisories into the model context for vulnerability triage and fixes. It uses the authenticated gh CLI, so it can read draft repository advisories when your GitHub account has access.

Features

• Automatically detects GHSA URLs and IDs in user prompts.
• Adds /ghsa for explicitly loading an advisory into the current session.
• Adds load_ghsa_advisory so the model can load an advisory on demand.
• Uses the repository security-advisory API first, preserving draft-only details such as the private fork.
• Includes the full description, PoC, affected versions, CVSS, CWEs, references, and private-fork metadata in a compact, expandable context message.
• Frames advisory text as untrusted report data and truncates large responses before adding them to context.

Requirements

• Node.js 22.19 or newer
• Pi
• GitHub CLI authenticated with access to the advisory:

gh auth status

The token normally needs repo access for private or draft repository advisories.

Install

Install the npm package globally in Pi:

pi install npm:pi-ghsa

Or install it for the current project only:

pi install -l npm:pi-ghsa

You can also load the GitHub repository directly:

pi install git:github.com/mcollina/pi-ghsa

For a quick test from a source checkout:

pi -e ./extensions/ghsa.ts

Usage

Paste an advisory URL in a prompt. The extension loads it before the model starts:

Fix https://github.com/OWNER/REPO/security/advisories/GHSA-xxxx-xxxx-xxxx

Or load it explicitly, then provide the fixing instructions in your next prompt:

/ghsa https://github.com/OWNER/REPO/security/advisories/GHSA-xxxx-xxxx-xxxx

Accepted references:

https://github.com/OWNER/REPO/security/advisories/GHSA-xxxx-xxxx-xxxx
OWNER/REPO#GHSA-xxxx-xxxx-xxxx
GHSA-xxxx-xxxx-xxxx

A bare GHSA identifier uses GitHub's public global-advisory endpoint. Draft advisories require the full repository URL or repository-qualified shorthand.

Security and privacy

The extension executes gh api as the current user. Advisory content is added to the Pi session and sent to the selected model provider as context. Review your provider's data-handling policy before loading confidential draft advisories.

If an advisory exceeds Pi's tool-output limits, the complete formatted context is written to a mode-0600 file inside a mode-0700 temporary directory and the model receives its path.

Development

git clone https://github.com/mcollina/pi-ghsa.git
cd pi-ghsa
npm install
npm run check

Before publishing:

npm pack --dry-run
npm publish

Bug reports and contributions are welcome in the GitHub repository.