santosomar/general-secure-coding-agent-skills/patch-advisor
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Recommends the specific code change to remediate a detected vulnerability by dispatching on CWE to the matching Project CodeGuard rule's prescribed fix pattern. Use after a finding has been confirmed and located, when the user asks how to fix a vulnerability, or when generating remediation PRs.
Install
npx vskill@latest install santosomar/general-secure-coding-agent-skills/patch-advisorSKILL.md
Patch Advisor
This skill delegates to Project CodeGuard for remediation patterns. Every CodeGuard rule includes an "Implementation Checklist" and concrete before→after code; this skill is the CWE→rule→fix lookup.
Upstream: <https://github.com/cosai-oasis/project-codeguard/tree/main/skills/software-security>
Dispatch (CWE → CodeGuard rule → fix section)
| CWE | CodeGuard rule | Fix pattern | |
|---|---|---|---|
| 89 | codeguard-0-input-validation-injection | PreparedStatement / parameterized query examples | |
| 78 | codeguard-0-input-validation-injection | ProcessBuilder / structured-exec + arg allow-list | |
| 79 | codeguard-0-client-side-web-security | Context-aware encoding, DOMPurify, Trusted Types | |
| 502 | codeguard-0-xml-and-serialization | yaml.safe_load, ObjectInputStream allow-list, TypeNameHandling=None | |
| 611 | codeguard-0-xml-and-serialization | disallow-doctype-decl, DtdProcessing.Prohibit, defusedxml | |
| 22 | codeguard-0-file-handling-and-uploads | Canonicalize-then-prefix-check; value allow-list | |
| 798 | codeguard-1-hardcoded-credentials | KMS/vault extraction; env injection at runtime | |
| 327 | codeguard-1-crypto-algorithms | Algorithm substitution table (MD5→SHA-256, AES-ECB→AES-GCM) | |
| 862 | codeguard-0-authorization-access-control | User-scoped query; middleware enforce; DTO allow-list |
Workflow
- Take CWE + language from the upstream finding.
- Look up the rule; extract the fix pattern for that language.
- Emit: the minimal diff, the rule ID it satisfies, and the rule's test-plan line for verification.
- If the CWE isn't in the table, fall back to the CodeGuard language→rules map and apply the closest rule's Implementation Checklist.
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/security/patch-advisor/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/santosomar/general-secure-coding-agent-skills/patch-advisor)