Skip to content

Add security failure skill#60

Merged
amrit110 merged 5 commits intomainfrom
add_security_failure_skill
Mar 24, 2026
Merged

Add security failure skill#60
amrit110 merged 5 commits intomainfrom
add_security_failure_skill

Conversation

@amrit110
Copy link
Copy Markdown
Member

This pull request adds a new skill for handling pip-audit security failures and updates the agent's workflow and user-facing documentation to provide clearer, more robust handling of dependency vulnerabilities. The main focus is on ensuring that the bot only attempts to fix vulnerabilities when a patched version is available and gracefully exits with an explanatory comment when no fix exists upstream.

Security vulnerability handling improvements:

  • Added a new skill /fix-security-failures with detailed instructions for triaging pip-audit findings, updating dependencies when possible, and posting a PR comment (without making changes) if no patched version is available. (.claude/skills/fix-security-failures/SKILL.md)
  • Updated the agent's prompt and workflow to reference the new /fix-security-failures skill for pip-audit/CVE failures, ensuring the correct process is followed. (src/aieng_bot/agent_fixer/prompts.py) [1] [2]
  • Improved the summary and step-by-step explanation of security fixes in the dashboard UI, clarifying when the bot can auto-fix and when human intervention is required. (dashboard/components/failure-analysis.tsx) [1] [2]

Testing and context updates:

  • Updated tests to check that the new /fix-security-failures skill is included in the agent's prompt, ensuring coverage for the new workflow. (tests/agent_fixer/test_fixer.py)

@amrit110 amrit110 self-assigned this Mar 24, 2026
@amrit110 amrit110 added the enhancement New feature or request label Mar 24, 2026
@amrit110 amrit110 merged commit dd47a68 into main Mar 24, 2026
9 checks passed
@amrit110 amrit110 deleted the add_security_failure_skill branch March 24, 2026 17:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant