security-vulnerability-repair

name

security-vulnerability-repair

description

Use this skill when the user wants software-fix data focused on identifying, mitigating, or preventing security bugs. Trigger it for requests like 'make security repair tasks', 'generate vulnerability-fixing data', 'ensure the new feature is secure against XSS/injections', or 'create patching tasks for insecure code'. This applies both to patching existing vulnerabilities and securely implementing missing features where the primary challenge is defending against CWEs (like timing side-channels, broken access control, or header injections) during development. Do not use it for ordinary non-security defects.

Skill: security-vulnerability-repair

1. Capability Definition & Real Case

• Professional Definition: The ability to identify, repair, or proactively prevent security-relevant flaws—such as injections, missing access checks, timing attacks, or unsafe parsing—within a codebase. This comprises parsing vulnerability descriptions or security test suite logs, mapping the threat model to Trust Boundaries, and editing code to restore or build security invariants (e.g., parameterized queries, constant-time evaluations, URL sanitization) while rigorously preserving intended functional behaviors.
• Dimension Hierarchy: Repository Maintenance and Repair->Issue-Driven Repair->security-vulnerability-repair

Real Case

[Case 1]

• Initial Environment: A web application repository includes a failing test showing that crafted login input can bypass authentication by altering the generated query. The repository contains request handlers, query helpers, and authentication tests.
• Real Question: Repair the login flow so malicious input cannot change the meaning of the database query.
• Real Trajectory: Trace the login request from handler to query construction, confirm unsafe string interpolation, replace it with parameterized query handling, and run the targeted authentication security tests plus standard login regressions.
• Real Answer: The login path now binds user input safely and rejects malicious query-shaping input while preserving valid authentication behavior.
• Why this demonstrates the capability: This is a security-repair task because the failure is defined by exploitability. The agent must understand the vulnerability mechanism, patch the security boundary, and verify both exploit closure and preserved functionality.

---

[Case 2]

• Initial Environment: A Java service includes a vulnerability report explaining that a token-validation step omits an integrity check before accepting a session token. Regression tests include one newly failing security case and multiple passing session-management tests.
• Real Question: Add the missing cryptographic validation step before accepting session tokens.
• Real Trajectory: Inspect the token verification path, compare expected validation sequence with neighboring helpers, insert the integrity check before claims are trusted, and rerun the security test together with session lifecycle tests.
• Real Answer: Session tokens are only accepted after the full validation sequence completes, including the previously omitted integrity verification step.
• Why this demonstrates the capability: The task specifically evaluates security repair because the patch must restore a protection guarantee. The correct trajectory requires security-aware reasoning about validation order and trust boundaries.

---

[Case 3]

• Initial Environment: A web-based CMS repository is missing the converter logic for rich text Draft.js entities. The environment provides a Draft.js to HTML conversion pipeline and a test suite targeting stored XSS vulnerabilities.
• Real Question: Implement the 'link_entity' function in the contentstate converter to handle URLs, ensuring that all external links are properly sanitized against dangerous URI schemes.
• Real Trajectory: The agent audits the module, extracts constraints, and implements mapping logic for page IDs using a raw anchor tag template. Running the tests reveals a security failure where the 'javascript:' scheme can be injected. The agent refines the logic by integrating the project's 'check_url' utility to enforce a strict scheme allow-list. Functional verification confirms links are correct, and security verification confirms sanitization.
• Real Answer: A 'link_entity' converter that utilizes a 'check_url' wrapper to strip malicious schemes from external anchor tags while preserving internal page linking logic.
• Why this demonstrates the capability: This extends vulnerability repair into 'Secure Feature Development'. Success requires the agent to recognize security risks (Stored XSS) in a newly requested feature and apply robust, project-specific mitigations before finalizing the implementation.

Pipeline Execution Instructions

To synthesize data for this capability, you must strictly follow a 3-phase pipeline. Do not hallucinate steps. Read the corresponding reference file for each phase sequentially:

1. Phase 1: Environment Exploration Read the exploration guidelines to discover raw knowledge seeds: references/EXPLORATION.md

2. Phase 2: Trajectory Selection Once Phase 1 is complete, read the selection criteria to evaluate the trajectory: references/SELECTION.md

3. Phase 3: Data Synthesis Once a trajectory passes Phase 2, read the synthesis instructions to generate the final data: references/SYNTHESIS.md