agentic-security:security-fix-finding

To patch a security finding deterministically, this skill orchestrates an MCP pipeline that synthesizes, verifies, and applies the fix to the exact code location referenced by a finding id.

The security remediation pipeline follows a strict synthesize_fix, verify_fix, and apply_fix sequence to ensure patches are validated and tested before being applied to the codebase.

No, applying a security patch without verification is blocked by a strict no-Edit policy, ensuring every synthesized fix passes the verification stage before modifying your code.

You can remediate a specific vulnerability by referencing its stableId or id, which the skill validates against last-scan.json before targeting and patching that exact finding.

Yes, the safe patching workflow validates the patch against the current code state and runs your project tests after applying the fix to ensure no regressions were introduced.

If the finding id does not exist in last-scan.json, the scoped remediation process halts because the skill enforces existence checks to confirm the finding before attempting any patch synthesis.