fix
Get fix intelligence for a vulnerability and propose concrete remediation for the current repository
Profile →npx skills add davepoon/buildwithclaude --skill fix --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
The skill fetches fix intelligence for a vulnerability and proposes concrete, actionable remediation steps for the current repository.
How it works
- It operates with allowed tools: Bash, Read, Glob, Grep, Edit, Write, WebFetch.
- It processes vulnerability data to generate a Markdown report containing fix options, version diffs, and verification summaries, formatted directly as Markdown.
- It prioritizes displaying version and provenance information for each affected package, including current version, version source, fix target version, fix source, and Safe Harbour confidence.
- It uses a data processing cascade: first jq/yq with bash builtins for JSON/YAML shaping, then uv for advanced analysis/visualization if available, and finally Python stdlib as a last resort, always checking for tool availability with command -v.
- It must present outputs as Markdown, with optional Mermaid diagrams for visual data such as dependency paths or fix option comparisons.
- It enforces reporting requirements by including, for each package, fields like Current Version, Version Source, Fix Target Version, Fix Source, and Safe Harbour.
When to use it
Use when you need to generate fix intelligence for a disclosed vulnerability in the repository and present concrete remediation steps, including versioning details and confidence scoring.
What it can touch
- Tools: Bash, Read, Glob, Grep, Edit, Write, WebFetch.
- It reads API responses or SBOM data to shape reports and may generate Mermaid diagrams or Python-based charts if uv is available.
Caveats
- Outputs are constrained to Markdown formatting; no scripts are produced unless expressed as Markdown in the output.
- The skill reports version provenance and Safe Harbour scores per package and adheres to the provided guidance on tool usage and data processing order.
- It requires that the vulnerability data includes current version, potential fix version, and a source to report accurately; if information is missing, sections may be omitted as per the rules.
# Vulnetix Fix Intelligence Skill This skill fetches fix intelligence for a vulnerability and proposes concrete, actionable remediation steps for the current repository. ## Output & Analysis Guidelines **Primary output format:** Markdown. All reports, tables, fix options, version diffs, and verification summaries MUST be presented as formatted markdown text directly — never generate scripts or programs to produce output that can be expressed as markdown. **Visual data — use Mermaid diagrams** to display data visually when it aids comprehension. Mermaid renders natively in markdown and requires no external tools. Use it for: - Dependency upgrade paths → `graph LR` showing current → target version with breaking change annotations - Fix option comparison → `quadrantChart` plotting Safe Harbour confidence vs. version change magnitude - Dependency tree showing vulnerable path → `graph TD` (root → parent → vulnerable dep) - Post-fix verification status → `flowchart` (scan → tests → result) Example — upgrade path: ````markdown ```mermaid graph LR A[log4j-core 2.14.1] -->|patch| B[2.14.2] A -->|minor| C[2.17.1 ✓ fix] A -->|major| D[3.0.0] style A fill:#f66,stroke:#333 style C fill:#6f6,str
- Output & Analysis Guidelines
- Mandatory Reporting Requirements
- Package Version Reporting
- Version Source Transparency
- Safe Harbour Confidence Score
- Vulnerability Memory File (.vulnetix/memory.yaml)
- Schema
- VEX Status Mapping (Internal → Developer Language)
- VEX Justification Mapping (for notaffected status)
- VEX Action Response Mapping (for affected status)
- User Decision Values
- Dependabot Integration
- Code Scanning (CodeQL) Integration
- Secret Scanning Integration
command -v uv &>/dev/null && uv run --with matplotlib python3 -c '
import matplotlib.pyplot as plt
command -v uv &>/dev/null && uv run --with pandas,matplotlib python3 -c '...'
command -v python3 &>/dev/null && python3 -c 'import json, sys; ...'
gh auth status 2>/dev/null
Get the repo owner/name from git remote
Find Dependabot PRs referencing this vulnerability or the affected package
List all open code scanning alerts
gh api repos/{owner}/{repo}/code-scanning/alerts?state=open --jq '[.[] | select(.rule.tags[]? | test("cwe-"; "i"))]'
Check for alerts matching a specific CWE (extracted from vuln context in Step 2)What does the fix skill do?
Get fix intelligence for a vulnerability and propose concrete remediation for the current repository
How do I install it?
Run `npx skills add davepoon/buildwithclaude --skill fix --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From davepoon/buildwithclaude, a repository with 3,251 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.