fix-security SKILL.md skillA
fix-security from devcodex-labs/devcodex is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add devcodex-labs/devcodex/fix-security@git:20260730.6ee304aPins git:20260730.6ee304a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- devcodex-labs/devcodex
- Path
content/skills/fix-security/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260730.6ee304a, committed Jul 30, 2026
- Size
- 1,663 bytes
- Repository stars
- 432
- License
- AGPL-3.0
安全修复子类型规范 — CVE/漏洞响应 + 四项安全专项扫描.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Fix Security Skill ## 触发条件 安全漏洞修复：CVE 响应、XSS/SQL注入/CSRF 修复、依赖漏洞升级、权限越权修复、敏感信息泄露处理。 ## 安全专项扫描（S1~S4） 在标准 fix 三步扫描之外，额外执行： | 扫描 | 内容 | 工具 | |------|------|------| | S1 漏洞验证 | 确认漏洞可重现 + CVSS 评分 | 手动/PoC | | S2 依赖扫描 | 全量依赖树安全检查 | `npm audit` / `pnpm audit` | | S3 代码扫描 | 修复文件及相关模块的安全模式检查 | 静态分析 | | S4 回归扫描 | 修复后重新运行 S1~S3 确认修复有效 | 同上 | ## 执行规则 - CP1 必须包含：漏洞描述 + CVSS 评分 + 影响版本范围 - CP2 必须包含：修复方案 + 是否需要 Breaking Change + 公告计划 - 安全 repair 必须执行 active `repair-prevention-assessment#RepairPreventionAssessmentGate` 且使用 `mode=full`；需要先启用控制时只能选择带授权、前瞻补证和 rollback/sunset 的 `emergency-active` - 安全修复 PR 描述中**禁止包含**漏洞细节（防止公开 CVE 前泄露） - 依赖升级必须检查 Peer Dependencies 兼容性 ## 发布流程 1. 修复完成 → 安全测试通过 2. 准备 Security Advisory 3. 协调发布节奏（如有 CVE 编号，对齐披露时间） 4. 发布 patch 版本 + CHANGELOG 安全公告 5. 输出安全报告：优先 `.devcodex/bugs/<问题>/reports/<agent>/YYYYMMDD/NN--security.md`；无任务上下文时回退到 `.devcodex/reports/bugs/<agent>/YYYYMMDD/NN--security.md`
Read the whole file at its exact version.
How to install
mdr add devcodex-labs/devcodex/fix-security@sha256:ba00055f013aa556The line at the top of this page pins the label git:20260730.6ee304a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_ekuxu6veh4w26s2l)
5 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Jul 30, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (1663 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
devcodex-labs/devcodex · 432 stars · license AGPL-3.0 · pushed 2026-10-27 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_ekuxu6veh4w26s2l GET https://markdownregistry.com/api/v1/resolve?ref=devcodex-labs/devcodex/fix-security GET https://markdownregistry.com/api/v1/blob/ba00055f013aa556f99f4b8ef4f0524306ff4f01b7610db19957a34caa31316d
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.