# Security Vulnerability Repair

> Use this skill when the user wants software-fix data focused on identifying, mitigating, or preventing security bugs. Trigger it for requests like 'make security repair tasks', 'generate vulnerability-fixing data', 'ensure the new feature is secure against XSS/injections', or 'create patching tasks for insecure code'. This applies both to patching existing vulnerabilities and securely implementing missing features where the primary challenge is defending against CWEs (like timing side-channels, broken access control, or header injections) during development. Do not use it for ordinary non-security defects.

- Skill: `dingxingdi/security-vulnerability-repair` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add dingxingdi/security-vulnerability-repair`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dingxingdi/security-vulnerability-repair/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: dingxingdi (https://skillmd.com/u/dingxingdi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/dingxingdi/security-vulnerability-repair

---


# Skill: security-vulnerability-repair

## 1. Capability Definition & Real Case
* **Professional Definition**: The ability to identify, repair, or proactively prevent security-relevant flaws—such as injections, missing access checks, timing attacks, or unsafe parsing—within a codebase. This comprises parsing vulnerability descriptions or security test suite logs, mapping the threat model to Trust Boundaries, and editing code to restore or build security invariants (e.g., parameterized queries, constant-time evaluations, URL sanitization) while rigorously preserving intended functional behaviors.
* **Dimension Hierarchy**: Repository Maintenance and Repair->Issue-Driven Repair->security-vulnerability-repair

### Real Case
**[Case 1]**
* **Initial Environment**: A web application repository includes a failing test showing that crafted login input can bypass authentication by altering the generated query. The repository contains request handlers, query helpers, and authentication tests.
* **Real Question**: Repair the login flow so malicious input cannot change the meaning of the database query.
* **Real Trajectory**: Trace the login request from handler to query construction, confirm unsafe string interpolation, replace it with parameterized query handling, and run the targeted authentication security tests plus standard login regressions.
* **Real Answer**: The login path now binds user input safely and rejects malicious query-shaping input while preserving valid authentication behavior.
* **Why this demonstrates the capability**: This is a security-repair task because the failure is defined by exploitability. The agent must understand the vulnerability mechanism, patch the security boundary, and verify both exploit closure and preserved functionality.
---
**[Case 2]**
* **Initial Environment**: A Java service includes a vulnerability report explaining that a token-validation step omits an integrity check before accepting a session token. Regression tests include one newly failing security case and multiple passing session-management tests.
* **Real Question**: Add the missing cryptographic validation step before accepting session tokens.
* **Real Trajectory**: Inspect the token verification path, compare expected validation sequence with neighboring helpers, insert the integrity check before claims are trusted, and rerun the security test together with session lifecycle tests.
* **Real Answer**: Session tokens are only accepted after the full validation sequence completes, including the previously omitted integrity verification step.
* **Why this demonstrates the capability**: The task specifically evaluates security repair because the patch must restore a protection guarantee. The correct trajectory requires security-aware reasoning about validation order and trust boundaries.
---
**[Case 3]**
* **Initial Environment**: A web-based CMS repository is missing the converter logic for rich text Draft.js entities. The environment provides a Draft.js to HTML conversion pipeline and a test suite targeting stored XSS vulnerabilities.
* **Real Question**: Implement the 'link_entity' function in the contentstate converter to handle URLs, ensuring that all external links are properly sanitized against dangerous URI schemes.
* **Real Trajectory**: The agent audits the module, extracts constraints, and implements mapping logic for page IDs using a raw anchor tag template. Running the tests reveals a security failure where the 'javascript:' scheme can be injected. The agent refines the logic by integrating the project's 'check_url' utility to enforce a strict scheme allow-list. Functional verification confirms links are correct, and security verification confirms sanitization.
* **Real Answer**: A 'link_entity' converter that utilizes a 'check_url' wrapper to strip malicious schemes from external anchor tags while preserving internal page linking logic.
* **Why this demonstrates the capability**: This extends vulnerability repair into 'Secure Feature Development'. Success requires the agent to recognize security risks (Stored XSS) in a newly requested feature and apply robust, project-specific mitigations before finalizing the implementation.

## Pipeline Execution Instructions
To synthesize data for this capability, you must strictly follow a 3-phase pipeline. **Do not hallucinate steps.** Read the corresponding reference file for each phase sequentially:

1. **Phase 1: Environment Exploration**
   Read the exploration guidelines to discover raw knowledge seeds:
   `references/EXPLORATION.md`

2. **Phase 2: Trajectory Selection**
   Once Phase 1 is complete, read the selection criteria to evaluate the trajectory:
   `references/SELECTION.md`

3. **Phase 3: Data Synthesis**
   Once a trajectory passes Phase 2, read the synthesis instructions to generate the final data:
   `references/SYNTHESIS.md`