| name | opengrep-autofix |
| description | Automatically fix GHAS code scanning findings generated by OpenGrep. Use this skill when the user wants to remediate security vulnerabilities found by OpenGrep/Semgrep, auto-fix GHAS alerts, or bulk-fix code scanning findings. Triggers on requests like "fix opengrep findings", "remediate GHAS alerts", "auto-fix security vulnerabilities", or "fix code scanning results". |
OpenGrep Autofix
Fetch GHAS code scanning alerts created by OpenGrep, analyze each vulnerability, and write code fixes. Each fix is an independent commit on a new branch, and a pull request is opened when complete.
Prerequisites
- gh CLI — installed and authenticated (
gh auth login)
- git — installed and configured
- python3 — Python 3.6+
- opengrep or semgrep CLI — installed (
curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash or pip install semgrep) for local verification of fixes
- GHAS code scanning — enabled on the repository with the OpenGrep workflow having run at least once
Run the check script before starting:
bash <skill-path>/scripts/check_prereqs.sh
If any checks fail, resolve them before proceeding.
Workflow
- Check prerequisites
- Set up a fix branch
- Fetch open code scanning alerts (and save for later comparison)
- Fix each alert in parallel (via subagents)
- Verify fixes by running OpenGrep locally against the fixed code
- Open a pull request
Step 1: Check Prerequisites and Set Up Fix Branch
Run the prerequisite check first:
bash <skill-path>/scripts/check_prereqs.sh
Then create the fix branch:
git checkout -b opengrep-autofix-$(date +%Y%m%d-%H%M%S)
Step 2: Fetch Open Code Scanning Alerts
Run the fetch script to get all open alerts as JSON. Save the output to a file — it is needed later for verification:
python3 <skill-path>/scripts/fetch_alerts.py --tool-name "Opengrep OSS" > /tmp/opengrep_alerts.json
cat /tmp/opengrep_alerts.json
This outputs a JSON array of alerts. Each alert contains:
number — alert IDrule.id — the OpenGrep/Semgrep rule that triggeredrule.description — human-readable description of the vulnerabilityrule.security_severity_level — severity (critical, high, medium, low)most_recent_instance.location.path — file pathmost_recent_instance.location.start_line / end_line — line rangemost_recent_instance.message.text — specific finding messagehtml_url — link to the alert on GitHub
If there are no open alerts, inform the user and stop.
Step 3: Fix Each Alert via Subagents
For each alert, spawn a Task subagent (subagent_type: "general-purpose") to process the fix. Run subagents in parallel for independent findings. When multiple findings affect the same file, process them sequentially to avoid conflicts.
Subagent Prompt Template
For each alert, provide the subagent with this context:
Fix this OpenGrep/GHAS security finding:
- Alert #{number}: {rule.id}
- Severity: {security_severity_level}
- File: {location.path}, lines {start_line}-{end_line}
- Description: {rule.description}
- Finding message: {message.text}
- Alert URL: {html_url}
Instructions:
1. Read the affected file to understand the surrounding code context
2. Analyze the vulnerability described by the rule. Fetch references to understand the vulnerability and common fix patterns. Use the rule ID to guide your research.
3. Consult <skill-path>/references/fix-patterns.md for common fix strategies
4. Implement the MINIMAL fix that resolves the vulnerability without changing behavior
5. Stage ONLY the modified file(s) and commit with message format:
fix: resolve {rule.id} in {path}
{one-line description of what was changed}
Fixes GHAS alert #{number}
IMPORTANT:
- Do NOT change application logic beyond what is needed to fix the vulnerability
- Preserve existing code style and formatting
- If the fix is unclear or risky, skip it and report why
Grouping Strategy
Before spawning subagents, group alerts by file path. For each file:
- If only one alert: spawn a subagent immediately
- If multiple alerts in the same file: spawn ONE subagent that fixes all alerts in that file sequentially, committing each fix independently
This prevents merge conflicts from concurrent edits to the same file.
Step 4: Verify Fixes with Local OpenGrep Scan
GHAS alerts won't update until a new scan runs on the pushed branch. To verify fixes immediately, run OpenGrep locally against the fixed code and compare against the original alerts:
python3 <skill-path>/scripts/verify_fixes.py --alerts-json /tmp/opengrep_alerts.json --severity ERROR
The script will:
- Run
opengrep (or semgrep) locally with the same config/severity as the CI workflow
- Compare local scan results against the original GHAS alerts
- Report which alerts were fixed, which remain, and any new findings (regressions)
If some fixes didn't resolve the underlying finding, review and reattempt those. If new findings were introduced, fix those as well before proceeding.
Report to the user:
- How many alerts were verified as fixed by the local scan
- How many alerts still trigger locally (if any) and why
- Any new findings introduced by the fixes
- Any alerts that were skipped
Step 5: Open a Pull Request
Push the branch and create a PR:
git push -u origin HEAD
gh pr create --title "fix: auto-remediate OpenGrep security findings" --body "$(cat <<'EOF'
## Summary
Automated fixes for GHAS code scanning alerts generated by OpenGrep.
### Alerts addressed
[list each alert number, rule ID, file, and one-line summary]
### Alerts skipped (if any)
[list any alerts that could not be fixed and explain why]
## Verification
Fixes were verified by running OpenGrep locally against the patched code.
### Local scan results
[include summary from verify_fixes.py output: fixed count, remaining count, etc.]
## Test plan
- [ ] Verify each commit addresses its specific alert
- [ ] Confirm the automated OpenGrep scan passes on the PR branch
- [ ] Review fixes for correctness and no behavior changes
🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)"
Report the PR URL to the user.
References
