fix-vulns-git-integration

fix-vulns-git-integration is an Application security skill for AI agents, published by linuxfoundation in the crowd.dev repository on GitHub. Skillspace rates fix-vulns-git-integration F (53/100) and it passed the safety scan; the rating is based on static analysis only.

Automated vulnerability triage and dependency bumps for the git_integration worker (Python via uv + the two vendored Go modules). Fetches open Dependabot alerts scoped to git_integration manifests, correlates them with open Dependabot PRs, classifies each fix as safe or needs-human, validates safe fixes locally on the PR branches merged with latest main (uv sync / lint / pytest + full git-integration image build, which compiles both Go modules), updates safe PR branches server-side so they are one click from merge, then posts a "safe to merge" review summary to Slack and opens PRs for alerts Dependabot has no PR for. NEVER merges PRs, never dismisses alerts, never deploys without explicit user confirmation. Use when the user says "fix vulns", "bump deps", "dependabot triage", or asks about git_integration vulnerabilities.

Grade
F
Quality
53 / 100
Safety
Passed
GitHub stars
3,369

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

View source on GitHublinuxfoundation/crowd.dev

Our review

Architecture
73 / 100
Maturity
Basic: a single SKILL.md
Security scan
No issues found
License
Not declared. Check the repository before reusing it.

Not checked yet

  • Category is a classifier prediction; no model has read this skill yet
  • Not judged on the rubric yet (not a contender in its category)
  • No blind task eval yet
  • Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
  • Sibling files (scripts, references) not fetched; security scan covers SKILL.md only

Better-rated skills in Application security

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.