| name | security-vulnerability-repair |
| description | Use this skill when the user wants software-fix data focused on identifying, mitigating, or preventing security bugs. Trigger it for requests like 'make security repair tasks', 'generate vulnerability-fixing data', 'ensure the new feature is secure against XSS/injections', or 'create patching tasks for insecure code'. This applies both to patching existing vulnerabilities and securely implementing missing features where the primary challenge is defending against CWEs (like timing side-channels, broken access control, or header injections) during development. Do not use it for ordinary non-security defects. |
Skill: security-vulnerability-repair
1. Capability Definition & Real Case
- Professional Definition: The ability to identify, repair, or proactively prevent security-relevant flaws—such as injections, missing access checks, timing attacks, or unsafe parsing—within a codebase. This comprises parsing vulnerability descriptions or security test suite logs, mapping the threat model to Trust Boundaries, and editing code to restore or build security invariants (e.g., parameterized queries, constant-time evaluations, URL sanitization) while rigorously preserving intended functional behaviors.
- Dimension Hierarchy: Repository Maintenance and Repair->Issue-Driven Repair->security-vulnerability-repair
Real Case
[Case 1]
- Initial Environment: A web application repository includes a failing test showing that crafted login input can bypass authentication by altering the generated query. The repository contains request handlers, query helpers, and authentication tests.
- Real Question: Repair the login flow so malicious input cannot change the meaning of the database query.
- Real Trajectory: Trace the login request from handler to query construction, confirm unsafe string interpolation, replace it with parameterized query handling, and run the targeted authentication security tests plus standard login regressions.
- Real Answer: The login path now binds user input safely and rejects malicious query-shaping input while preserving valid authentication behavior.
- Why this demonstrates the capability: This is a security-repair task because the failure is defined by exploitability. The agent must understand the vulnerability mechanism, patch the security boundary, and verify both exploit closure and preserved functionality.
[Case 2]
- Initial Environment: A Java service includes a vulnerability report explaining that a token-validation step omits an integrity check before accepting a session token. Regression tests include one newly failing security case and multiple passing session-management tests.
- Real Question: Add the missing cryptographic validation step before accepting session tokens.
- Real Trajectory: Inspect the token verification path, compare expected validation sequence with neighboring helpers, insert the integrity check before claims are trusted, and rerun the security test together with session lifecycle tests.
- Real Answer: Session tokens are only accepted after the full validation sequence completes, including the previously omitted integrity verification step.
- Why this demonstrates the capability: The task specifically evaluates security repair because the patch must restore a protection guarantee. The correct trajectory requires security-aware reasoning about validation order and trust boundaries.
[Case 3]
- Initial Environment: A web-based CMS repository is missing the converter logic for rich text Draft.js entities. The environment provides a Draft.js to HTML conversion pipeline and a test suite targeting stored XSS vulnerabilities.
- Real Question: Implement the 'link_entity' function in the contentstate converter to handle URLs, ensuring that all external links are properly sanitized against dangerous URI schemes.
- Real Trajectory: The agent audits the module, extracts constraints, and implements mapping logic for page IDs using a raw anchor tag template. Running the tests reveals a security failure where the 'javascript:' scheme can be injected. The agent refines the logic by integrating the project's 'check_url' utility to enforce a strict scheme allow-list. Functional verification confirms links are correct, and security verification confirms sanitization.
- Real Answer: A 'link_entity' converter that utilizes a 'check_url' wrapper to strip malicious schemes from external anchor tags while preserving internal page linking logic.
- Why this demonstrates the capability: This extends vulnerability repair into 'Secure Feature Development'. Success requires the agent to recognize security risks (Stored XSS) in a newly requested feature and apply robust, project-specific mitigations before finalizing the implementation.
Pipeline Execution Instructions
To synthesize data for this capability, you must strictly follow a 3-phase pipeline. Do not hallucinate steps. Read the corresponding reference file for each phase sequentially:
-
Phase 1: Environment Exploration
Read the exploration guidelines to discover raw knowledge seeds:
references/EXPLORATION.md
-
Phase 2: Trajectory Selection
Once Phase 1 is complete, read the selection criteria to evaluate the trajectory:
references/SELECTION.md
-
Phase 3: Data Synthesis
Once a trajectory passes Phase 2, read the synthesis instructions to generate the final data:
references/SYNTHESIS.md
