[yanjost]

Summary

Add a repo-local skill for writing and updating customer-facing Scalingo Security Bulletins. It draws on PHP2Shell, eMudhra, and the Node2Shell bulletin PR.

The skill covers evidence checks, actionable customer instructions, publication history, and a required adversarial review from the customer's point of view.

Security review (self)

• No secrets, tokens, credentials, internal URLs, or private hostnames were added.
• No user-input handling or authentication code changed. The guidance calls out false assurance from available fixes, version pins, incomplete mitigations, and unverified publication claims.

Test plan

• quick_validate.py .agents/skills/scalingo-security-bulletin checks skill front matter and structure.
• A local check confirms all three linked bulletin examples resolve and the adversarial review section exists.
• docker compose run --rm web bundle exec jekyll build confirms the documentation build still succeeds.