fix-vulns-git-integration
Automated vulnerability triage and dependency bumps for the git_integration worker (Python via uv + the two vendored Go modules). Fetches open Dependabot alerts scoped to git_integration manifests, correlates them with open Dependabot PRs, classifies each fix as safe or needs-human, validates safe fixes locally on the PR branches merged with latest main (uv sync / lint / pytest + full git-integration image build, which compiles both Go modules), updates safe PR branches server-side so they are one click from merge, then posts a "safe to merge" review summary to Slack and opens PRs for alerts Dependabot has no PR for. NEVER merges PRs, never dismisses alerts, never deploys without explicit user confirmation. Use when the user says "fix vulns", "bump deps", "dependabot triage", or asks about git_integration vulnerabilities.
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow fetches open GitHub Dependabot alerts and open Dependabot pull requests from a repository via the `gh api`, exposing the agent to outsider-authored vulnerability descriptions and pull request metadata.
- Repository
linuxfoundation/crowd.dev
- Revision
8b8fae2
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.