[cliffhall]

Closes #2851

Updates .claude/skills/security-advisory/SKILL.md:

• Step 1, card body: replaces the "do not copy the vulnerability description onto the card" warning. The card may now carry the full analysis (description, reproduction, ownership verdict, affected lines, fix plan), since advisories have no comment API and the card is the only place the team can see it. States the premise (board Add tab and approval flow for server -> client sampling #28 access is managed) and what to do if board access is ever widened.
• Step 1, score note: drops the "numbers and rubric names only" restriction. The score now takes the ordinary /issue-triage form, with a free-text justification per axis.
• Publication rules unchanged: says explicitly that the public issue still waits for publication and that upstream findings still go through the upstream's private channel.
• Step 6: new warning that converting the draft makes its body public, so review and trim it before converting.

Checked board-ops, issue-triage, AGENTS.md and docs/: none restates the old rule, so this is the only file changed. The skill's description is unchanged, so skills:eval was not re-run. verify:skills and npm run local:gate pass.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the security-advisory workflow documentation update.

No open issues 🎉

What changed in this PR

Updates the security-advisory workflow documentation for #2851, allowing full analysis on private draft cards while preserving publication safeguards.

Changes:

• Allows detailed advisory analysis on cards, provided board #28’s audience remains restricted to advisory handlers.
• Permits free-text justifications alongside Priority scores.
• Requires reviewing and trimming card bodies before conversion into public issues; publication timing and upstream private-reporting rules remain unchanged.

File	Description
.claude/​skills/​security-advisory/​SKILL.md	Revises card-content and scoring guidance and adds a pre-conversion disclosure warning.

_{Review effort: Balanced}

[cliffhall]

Copilot review loop closed: round 1 was clean (no inline comments, no headline issue, no suppressed comments), so per the stop rule no further round was requested. CI is green.