opengrep-autofix

name	opengrep-autofix
description	Automatically fix GHAS code scanning findings generated by OpenGrep. Use this skill when the user wants to remediate security vulnerabilities found by OpenGrep/Semgrep, auto-fix GHAS alerts, or bulk-fix code scanning findings. Triggers on requests like "fix opengrep findings", "remediate GHAS alerts", "auto-fix security vulnerabilities", or "fix code scanning results".

OpenGrep Autofix

Fetch GHAS code scanning alerts created by OpenGrep, analyze each vulnerability, and write code fixes. Each fix is an independent commit on a new branch, and a pull request is opened when complete.

Prerequisites

• gh CLI — installed and authenticated (gh auth login)
• git — installed and configured
• python3 — Python 3.6+
• opengrep or semgrep CLI — installed (curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash or pip install semgrep) for local verification of fixes
• GHAS code scanning — enabled on the repository with the OpenGrep workflow having run at least once

Run the check script before starting:

bash <skill-path>/scripts/check_prereqs.sh

If any checks fail, resolve them before proceeding.

Workflow

1. Check prerequisites
2. Set up a fix branch
3. Fetch open code scanning alerts (and save for later comparison)
4. Fix each alert in parallel (via subagents)
5. Verify fixes by running OpenGrep locally against the fixed code
6. Open a pull request

Step 1: Check Prerequisites and Set Up Fix Branch

Run the prerequisite check first:

bash <skill-path>/scripts/check_prereqs.sh

Then create the fix branch:

git checkout -b opengrep-autofix-$(date +%Y%m%d-%H%M%S)

Step 2: Fetch Open Code Scanning Alerts

Run the fetch script to get all open alerts as JSON. Save the output to a file — it is needed later for verification:

python3 <skill-path>/scripts/fetch_alerts.py --tool-name "Opengrep OSS" > /tmp/opengrep_alerts.json
cat /tmp/opengrep_alerts.json

This outputs a JSON array of alerts. Each alert contains:

• number — alert ID
• rule.id — the OpenGrep/Semgrep rule that triggered
• rule.description — human-readable description of the vulnerability
• rule.security_severity_level — severity (critical, high, medium, low)
• most_recent_instance.location.path — file path
• most_recent_instance.location.start_line / end_line — line range
• most_recent_instance.message.text — specific finding message
• html_url — link to the alert on GitHub

If there are no open alerts, inform the user and stop.

Step 3: Fix Each Alert via Subagents

For each alert, spawn a Task subagent (subagent_type: "general-purpose") to process the fix. Run subagents in parallel for independent findings. When multiple findings affect the same file, process them sequentially to avoid conflicts.

Subagent Prompt Template

For each alert, provide the subagent with this context:

Fix this OpenGrep/GHAS security finding:

- Alert #{number}: {rule.id}
- Severity: {security_severity_level}
- File: {location.path}, lines {start_line}-{end_line}
- Description: {rule.description}
- Finding message: {message.text}
- Alert URL: {html_url}

Instructions:
1. Read the affected file to understand the surrounding code context
2. Analyze the vulnerability described by the rule.  Fetch references to understand the vulnerability and common fix patterns. Use the rule ID to guide your research.
3. Consult <skill-path>/references/fix-patterns.md for common fix strategies
4. Implement the MINIMAL fix that resolves the vulnerability without changing behavior
5. Stage ONLY the modified file(s) and commit with message format:
   fix: resolve {rule.id} in {path}

   {one-line description of what was changed}

   Fixes GHAS alert #{number}

IMPORTANT:
- Do NOT change application logic beyond what is needed to fix the vulnerability
- Preserve existing code style and formatting
- If the fix is unclear or risky, skip it and report why

Grouping Strategy

Before spawning subagents, group alerts by file path. For each file:

• If only one alert: spawn a subagent immediately
• If multiple alerts in the same file: spawn ONE subagent that fixes all alerts in that file sequentially, committing each fix independently

This prevents merge conflicts from concurrent edits to the same file.

Step 4: Verify Fixes with Local OpenGrep Scan

GHAS alerts won't update until a new scan runs on the pushed branch. To verify fixes immediately, run OpenGrep locally against the fixed code and compare against the original alerts:

python3 <skill-path>/scripts/verify_fixes.py --alerts-json /tmp/opengrep_alerts.json --severity ERROR

The script will:

1. Run opengrep (or semgrep) locally with the same config/severity as the CI workflow
2. Compare local scan results against the original GHAS alerts
3. Report which alerts were fixed, which remain, and any new findings (regressions)

If some fixes didn't resolve the underlying finding, review and reattempt those. If new findings were introduced, fix those as well before proceeding.

Report to the user:

• How many alerts were verified as fixed by the local scan
• How many alerts still trigger locally (if any) and why
• Any new findings introduced by the fixes
• Any alerts that were skipped

Step 5: Open a Pull Request

Push the branch and create a PR:

git push -u origin HEAD
gh pr create --title "fix: auto-remediate OpenGrep security findings" --body "$(cat <<'EOF'
## Summary
Automated fixes for GHAS code scanning alerts generated by OpenGrep.

### Alerts addressed
[list each alert number, rule ID, file, and one-line summary]

### Alerts skipped (if any)
[list any alerts that could not be fixed and explain why]

## Verification
Fixes were verified by running OpenGrep locally against the patched code.

### Local scan results
[include summary from verify_fixes.py output: fixed count, remaining count, etc.]

## Test plan
- [ ] Verify each commit addresses its specific alert
- [ ] Confirm the automated OpenGrep scan passes on the PR branch
- [ ] Review fixes for correctness and no behavior changes

🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)"

Report the PR URL to the user.

References

• Fix patterns: See references/fix-patterns.md for common PHP vulnerability fix strategies