threat-patch

name

threat-patch

description

Remediate security findings by producing minimal, surgical code patches. Triggers on 'patch security findings', 'fix vulnerabilities', 'remediate findings', 'threat patch', or when the user provides a findings.json (from threat-model), a Codex security findings CSV, a THREAT-MODEL.md, or individual vulnerability descriptions and wants them fixed. Also trigger when reviewing code flagged by a security scanner and the user wants actionable fixes rather than just reports.

Threat Patch

Reads security findings and produces minimal, surgical code patches with structured documentation. Fixes are code-grounded — each patch targets specific files and functions identified in the finding. Output includes a summary, validation steps, and the code changes.

When to Apply

• User provides a findings.json (from threat-model) and wants fixes
• User provides a Codex security findings CSV and wants fixes
• User has a THREAT-MODEL.md and wants to remediate identified risks
• User describes a specific vulnerability and wants a patch
• Reviewing security scanner output and needs actionable fixes
• After a security audit, turning findings into code changes

Input Sources (priority order)

Source	What It Provides	How to Use
findings.json (from threat-model)	Structured findings with data flow traces, systemic groupings, exploit chains, and severity ratings	Read directly — richest input, already triaged and grouped
Codex CSV	Title, description, severity, relevant_paths per finding	Run scripts/parse-findings.sh <csv-path> to extract structured output
THREAT-MODEL.md	Human-readable threat model