skills.rest
antstanley
antstanleyCOMMUNITY
Explore all skills by this author →
GitHub

fix-finding

Implements and verifies minimal patches for validated security findings.

Updated May 4, 2026
Search Tags:#code review#security#verification#remediation#regression testing#patch#vulnerability fix
One-click install
npx skills add https://github.com/antstanley/skills --skill fix-finding-antstanley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fix-finding
Source: https://github.com/antstanley/skills/tree/main/plugins/security/skills/fix-finding
Command: npx skills add https://github.com/antstanley/skills --skill fix-finding-antstanley

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Turning a confirmed security finding into a correct fix is error-prone: patches often miss the real vulnerable boundary, break legitimate behavior, or claim success without verification. This Skill enforces a disciplined workflow that revalidates the finding, builds a patch contract, implements the smallest repository-native fix, and proves closure through ordered verification gates. ## Core Features & Use Cases - Patch Contract: Establishes the source-to-sink path, attacker-controlled input, security invariant, and compatibility constraints before any code is edited. - Ordered Verification Gates: Verifies applicability, security closure, bypass resistance, preserved behavior, and repository checks in a strict sequence where earlier gates cannot be traded for later ones. - Staged Remediation: Supports generate, apply, and verify stages separately, so patches can be produced as unified diffs, applied later, and verified independently. - Use Case: A security scan flags an SQL injection in a request handler. Use this Skill to reproduce the issue with a failing regression test, apply the narrowest fix using existing query helpers, and prove the exploit no longer reproduces while legitimate queries still work. ## Quick Start Fix and verify the validated SQL injection finding in the user login handler, then report the outcome with the commands you ran.

Frequently Asked Questions about fix-finding

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix a validated security finding in my codebase?▼

Revalidate the finding by proving the vulnerable source-to-sink path in the current checkout, then complete a patch contract covering the security invariant and compatibility constraints. Implement the smallest repository-native fix with regression tests, and verify through ordered gates before reporting fixed.

How to verify a security patch actually closes a vulnerability?▼

Rerun the original proof of concept or exploit check against the patched code and re-trace the source-to-sink path. Then perform a change-aware bypass review with alternate malicious inputs, confirm legitimate behavior is preserved, and run the repository's relevant test and lint checks.

Can I generate a security patch without applying it to my working tree?▼

Yes, the generate stage produces one canonical unified diff containing the complete source and regression-test change while keeping the target checkout unchanged. The patch is developed in an isolated worktree and recorded against a base revision for later application.

What happens when a security finding cannot be reproduced?▼

If the broken security boundary cannot be shown after a bounded investigation, the Skill does not patch adjacent weaknesses or add speculative defenses. It returns no_change when evidence shows the path is already safe, or blocked with the missing proof documented.

When should a security fix be reported as blocked instead of fixed?▼

A fix is blocked when the only complete remediation requires an unresolved product policy, public-API compatibility, or cross-subsystem ownership decision, or when relevant validation cannot run. The report must state the options, security tradeoff, and exactly which check failed or is missing.

Related Skills

Explore More Software Engineering Skills→
openaiopenai
5.3k

security-scan

Runs a single-pass security audit of a repository or scoped path and generates a findings report.

Official
Advanced
anthropicsanthropics
35.8k

claude-security

Scan codebases, diffs, and commits for vulnerabilities and generate verified patch files.

Official
Advanced
ElbertePlinioElbertePlinio

vulnerability-validation

Validate code scan findings and generate structured JSON with exploitability details.

Community
Intermediate
johnqtcgjohnqtcg
29

security-review

Identify exploitable risks in code changes and generate structured security reports.

Community
Advanced