Security Vulnerability Fixer

Applies surgical security remediations for common OWASP vulnerabilities: SQL injection, path traversal, command injection, SSRF, and dependency CVEs.

1. Purpose

Eliminate security vulnerabilities without breaking legitimate application workflows.

2. When to Use

Use this skill when:

• Fixing static analysis security alerts (SonarQube, CodeQL, Snyk).
• Replacing string concatenation in SQL queries with parameterized statements.
• Sanitizing file paths to prevent directory traversal (../).

3. When Not to Use

• Do not use for routine bug fixes without security impact; use minimal-bug-fix.

4. Required Inputs

• vulnerability_type: SQLi, Path Traversal, Command Injection, XSS, or Insecure Dependency.
• target_file: Source file containing the vulnerability.

5. Missing-Input Behavior

1. If file is unspecified: ask for file and line number.
2. Never "fix" security issues by disabling validation or turning off authentication.

6. Procedure

Follow these numbered actions:

1. Action 1: Identify Flawed Pattern
   • SQLi: query("SELECT ... " + id) -> Parameterized query.
   • Path Traversal: open(path) -> Path.resolve() and verify prefix within base dir.
   • Command Injection: exec("cmd " + arg) -> execFile(["cmd", arg]).
2. Action 2: Apply Standard Remediation
   • Use language standard parameterized APIs.
3. Action 3: Run Automated Tests
   • Confirm legitimate inputs continue to work.
4. Action 4: Emit Security Report
   • Format per Section 8.

7. Decision Rules

• Always reject user-supplied file paths that resolve outside the intended root directory.
• Never use eval() or exec() with unsanitized arguments.

8. Output Format

Emit the report using this template:

### Security Vulnerability Patch: [Vulnerability Type]

- **Target File**: `[path:line]`
- **Severity**: [Critical | High | Medium]
- **Status**: PATCHED & VERIFIED

#### Remediation Diff
```diff
[Diff showing parameterized or sanitized fix]

Verification Evidence

• [Test results showing fix works and blocks payload]

## 9. Verification Checklist
- [ ] Parameterized API or path resolution used.
- [ ] No regression on legitimate inputs.
- [ ] Test suite passes.

## 10. Common Failures and Recovery
| Failure Symptom | Cause | Recovery Action |
| :--- | :--- | :--- |
| Incomplete path sanitization | Stripping `../` with regex | Use canonical path resolution (`path.resolve()`) and check `startsWith(baseDir)`. |

## 11. Stop or Escalation Conditions
Stop and ask the user when:
- Remediation requires architectural overhaul of database communication layer.

## 12. Examples

### Example 1: Successful Execution
**Input:**
```text
File: src/files.ts:14
Vulnerability: Path traversal in readFile(req.query.path)

Output:

### Security Vulnerability Patch: Path Traversal

- **Target File**: `src/files.ts:14`
- **Severity**: High
- **Status**: PATCHED & VERIFIED

#### Remediation Diff
```diff
- const fullPath = path.join(BASE_DIR, req.query.path);
+ const safePath = path.resolve(BASE_DIR, req.query.path);
+ if (!safePath.startsWith(BASE_DIR)) {
+   throw new ForbiddenError("Path traversal detected");
+ }

Verification Evidence

• Verified path outside BASE_DIR throws 403 Forbidden.

### Example 2: Ambiguous or Missing Input
**Input:**
```text
Fix security.

Output:

### Security Vulnerability Patch: Halted - No Target

- **Status**: Halted

Please provide the vulnerability type, target file, and line number.

Example 3: Expected Final Output

Output:

### Security Vulnerability Patch: SQL Injection

- **Target File**: `src/db.py:22`
- **Severity**: Critical
- **Status**: PATCHED & VERIFIED