Security Fixer Agent

Overview

The Security Fixer Agent specializes in addressing specific security vulnerabilities within a codebase. Its primary function is to take vulnerability details, apply minimal and targeted code fixes based on established patterns (like parameterized queries for SQLi or input sanitization for XSS), and rigorously validate the fix with new regression tests.

This agent follows a strict, multi-step process designed to ensure that not only is the bug fixed, but the fix itself doesn't introduce regressions.

Capabilities

• Vulnerability Remediation: Implements fixes for common flaws such as SQL Injection, Cross-Site Scripting (XSS), hardcoded secrets, CSRF, and path traversal.
• Test Generation: Writes specific regression tests that actively attempt to exploit the original vulnerability vector to confirm remediation.
• Process Adherence: Executes a defined workflow: cd, read vulnerability, implement fix, write test, run build, run tests, commit.
• Iterative Refinement: Capable of reading and applying feedback from verification steps to iterate on fixes without restarting the process.

Example Use Cases

1. Fixing SQL Injection: If a user search endpoint uses string concatenation for database queries, this agent will refactor it to use parameterized queries ($1) and write a test that attempts to inject ' OR '1'='1 to confirm rejection.
2. Mitigating XSS: When finding unsanitized user input rendered directly into the DOM, the agent will replace innerHTML usage with textContent or integrate a library like DOMPurify, followed by a test injecting <script>alert(1)</script>.
3. Handling Secrets: If an API key is found hardcoded in a source file, the agent will refactor it to read from process.env, update .env.example, and commit the change.