fix-security-audit

Fix security vulnerabilities by running this Skill on a PR with vulnerability reports; it identifies CVEs from scanner logs, applies patched versions via uv (Python) or npm, regenerates lockfiles, and re-runs audits to confirm the fix.

Yes, it handles both Python and JavaScript projects. For Python, it uses uv or pip to update dependencies; for Node.js, it uses npm. It reads vulnerability data from .failure-logs.txt and applies the appropriate package manager workflow.

The Skill uses uv as the primary package manager for Python projects, npm for Node.js, and pip as a fallback. It selects the correct manager based on your project type and applies patches to update vulnerable dependencies to safe versions.

After patching, the Skill re-runs security audits (pip-audit, npm audit, or Snyk) to confirm vulnerabilities are resolved and commits changes per your PR branch guidelines, ensuring stability before merging.

Provide .failure-logs.txt containing vulnerability reports from scanners and .pr-context.json with PR metadata. The Skill parses these files to extract CVEs, determine severity, and apply targeted fixes.

Yes, the Skill regenerates lockfiles after applying package manager updates to ensure dependency trees remain consistent and security patches propagate through transitive dependencies.