| name | security-fix |
| description | Orchestrates test-driven fixes for Mattermost security tickets (Jira/Atlassian) with a Staff Security Engineer mindset: failing secure-behavior tests first, then implementation, then security review and edge-case loops, then opening a non-draft PR that follows `.github/PULL_REQUEST_TEMPLATE.md` when present, with a vague public description (no exploit detail). Use when the user invokes /security-fix:security-fix with a mattermost.atlassian.net browse URL, MM-* security work, backend permission or authorization bugs, or asks for this security TDD workflow. |
| disable-model-invocation | true |
Security fix (TDD, orchestrated)
Role of the invoking agent
The main agent is only an orchestrator. It must not write application code, tests, or fixes itself. It delegates every substantive step to separate sub agents (one focused task per sub agent). It tracks phases, passes artifacts (ticket summary, file paths, test names, failures), and decides when to loop.
Invocation
The user provides a Jira ticket URL, for example:
/security-fix:security-fix https://mattermost.atlassian.net/browse/MM-68140
Parse the issue key from the path (MM-68140). Fetch ticket details via Atlassian MCP (or the project's configured Jira integration) so sub agents get title, description, acceptance criteria, suggested remediation, and severity.
Typical scope: server-side issues (API handlers, stores, permission checks, role/team/channel scoping).
Sub agent model
Delegate to sub agents using the same model as the parent (inherit model). Do not switch the parent to a different model for delegation unless the user explicitly asks.
