dryrunsecurity/remediation
Helps fix security vulnerabilities identified by DryRunSecurity. Activates when the user shares a DryRunSecurity comment (from a GitHub PR or GitLab MR) or asks for help fixing any security finding including SQL injection, XSS, CSRF, SSRF, path traversal, command injection, authentication bypass, authorization flaws, and prompt injection. Researches authoritative sources and applies fixes grounded in the user's specific codebase context.
74
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
VULNERABILITY_TYPES.md
Vulnerability Types Reference
CWE References
When researching fixes, these CWE references provide formal vulnerability definitions:
| Vulnerability | CWE | Description |
|---|---|---|
| SQL Injection | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command |
| Cross-Site Scripting (XSS) | CWE-79 | Improper Neutralization of Input During Web Page Generation |
| Server-Side Request Forgery (SSRF) | CWE-918 | Server-Side Request Forgery |
| Missing Authorization | CWE-862 | Missing Authorization |
| Incorrect Authorization | CWE-863 | Incorrect Authorization |
| Cross-Site Request Forgery (CSRF) | CWE-352 | Cross-Site Request Forgery |
| Path Traversal | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory |
| Command Injection | CWE-78 | Improper Neutralization of Special Elements used in an OS Command |
Supported Vulnerability Categories
DryRunSecurity detects a wide range of vulnerabilities. The remediation process works for all types:
Traditional Web Vulnerabilities
- SQL Injection (SQLi)
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Server-Side Request Forgery (SSRF)
- Path Traversal
- Command Injection
API Security Issues
- Insecure Direct Object Reference (IDOR)
- Mass Assignment
- Authentication Bypass
- Authorization Bypass
Modern Concerns
- Prompt Injection
- LLM Security Issues
Language-Specific Issues
- Deserialization Vulnerabilities
- Type Confusion
Concurrency Issues
- Race Conditions
- Time-of-Check to Time-of-Use (TOCTOU)
Cryptographic Issues
- Weak Algorithms
- Key Management Problems