fix-vulns

fix-vulns is an Application security skill for AI agents, published by linuxfoundation in the insights repository on GitHub. Skillspace rates fix-vulns F (51/100) and it passed the safety scan; the rating is based on static analysis only.

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189). Starts by asking which scope to tackle (critical, high, medium/low, or specific advisories) with checkboxes. Fetches open alerts, dedupes them, classifies each by origin (submodule vs local, dev-only vs runtime), then fans out one break-risk agent per package that must PROVE the update is safe for this codebase before any fix is applied. Applies safe fixes one at a time with incremental validation and ends with a report of what was fixed and what needs a human. Fixing only: NEVER runs git operations (no branch, commit, push, or PR) and produces no commit/PR drafts — reviewing and shipping the changes is entirely up to the user. Never dismisses alerts or auto-applies major version bumps. Use when the user says "fix vulns", "fix vulnerabilities", "dependabot alerts", "security audit fix", or invokes /fix-vulns.

Grade
F
Quality
51 / 100
Safety
Passed
GitHub stars
245

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

View source on GitHublinuxfoundation/insights

Our review

Architecture
76 / 100
Maturity
Basic: a single SKILL.md
Security scan
Low-risk patterns
License
MIT
Adoption
Adopted by 0 other repositories, in 0 collections

What the scanner flagged

  • over-broad allowed-tools ('*')
  • mentions secrets in text

Not checked yet

  • Not judged on the rubric yet (not a contender in its category)
  • No blind task eval yet
  • Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
  • Sibling files (scripts, references) not fetched; security scan covers SKILL.md only

Better-rated skills in Application security

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.