diff --git a/AGENTS.md b/AGENTS.md
index 27ad92c6..cf841daa 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -360,7 +360,7 @@ configuration before executing any command:
 | `<framework>` | The framework root — `.apache-magpie/` (the gitignored snapshot) in adopting projects, `.` in framework standalone. Used in `uv run` and other invocations that address the framework's `tools/<name>/` subtrees. | Filesystem convention. |
 | `<tracker>` | GitHub slug of the (security) tracker repo (example: `airflow-s/airflow-s`). | `<project-config>/project.md` → `tracker_repo` |
 | `<upstream>` | GitHub slug of the upstream codebase the fixes land in (example: `apache/airflow`). | `<project-config>/project.md` → `upstream_repo` |
-| `<security-list>` | The project's security mailing list (example: `security@airflow.apache.org`). | `<project-config>/project.md` → `mailing_lists.security` |
+| `<security-list>` | The project's security mailing list (example: `security@airflow.apache.org`). | `<project-config>/project.md` → `security_list` (under **Mailing lists**) |
 | `<issue-tracker>` | URL of the project's general-issue tracker, distinct from the security tracker. | `<project-config>/issue-tracker-config.md` → `url` |
 | `<issue-tracker-project>` | Project key within the issue tracker (JIRA key or `owner/repo`). | `<project-config>/issue-tracker-config.md` → `project_key` |
 | `<runtime>` | Recipe for invoking the project's runtime on a single source file. | `<project-config>/runtime-invocation.md` |
diff --git a/skills/security-cve-allocate/SKILL.md b/skills/security-cve-allocate/SKILL.md
index c52185dc..8b2e4582 100644
--- a/skills/security-cve-allocate/SKILL.md
+++ b/skills/security-cve-allocate/SKILL.md
@@ -32,7 +32,7 @@ license: Apache-2.0
                        (example: `<tracker>`)
      <upstream>       → value of `upstream_repo:` in <project-config>/project.md
                        (example: `<upstream>`)
-     <security-list> → value of `mailing_lists.security:` in <project-config>/project.md
+     <security-list>  → value of `security_list:` in <project-config>/project.md
                        (example: `<security-list>`)
      <cve-tool>       → the CVE-tool adapter directory selected by
                        `cve_authority.tool:` in <project-config>/project.md