cve-fix

Automated CVE remediation that reads vulnerability details from Jira vulnerability tickets, applies multi-strategy dependency fixes, validates results, and…

Skill by flightctl

IndexedMIT★ 10

Write a review

Chalk Labs

Need help deploying cve-fix?

Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.

Book a call

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/flightctl-cve-fix

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Automated CVE remediation that reads vulnerability details from Jira vulnerability tickets, applies multi-strategy dependency fixes, validates results, and creates pull requests with full justification. Language-agnostic: supports Go, Node.js, Python, Java, Rust, Ruby. Use when patching CVEs, updating vulnerable dependencies, or responding to Jira vulnerability tickets. Activated by commands: /start, /scan, /patch, /validate, /pr, /backport, /close, /report.

Use cases: documents, security

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md and code. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found
Runs as: Python package

Network hosts it talks to 5

codeload.github.com · found in install command
github.com · found in code
gitlab.com · found in code
jira.invalid · found in code
not-github.com · found in code

Files it touches

~/.claude/skills/cve-fix
/tmp/art
/tmp/repo
Your home directory (~)
~/.config/.jira/.config.yml

What's inside

Skill name: cve-fix
Description: Automated CVE remediation that reads vulnerability details from Jira vulnerability tickets, applies multi-strategy dependency fixes, validates results, and creates pull requests with full justification. Language-agnostic: supports Go, Node.js, Python, Java, Rust, Ruby. Use when patching CVEs, updating vulnerable dependencies, or responding to Jira vulnerability tickets. Activated by commands: /start, /scan, /patch, /validate, /pr, /backport, /close, /report.
License: MIT
Instructions: 13 lines in SKILL.md · view on GitHub

Before installing

Ships executable scripts

Files (46)

README.md
SKILL.md
backport.md · commands/
close.md · commands/
patch.md · commands/
pr.md · commands/
report.md · commands/
scan.md · commands/
start.md · commands/
validate.md · commands/
guidelines.md
_common.py · scripts/
backport.py · scripts/
check_existing_prs.py · scripts/
close.py · scripts/
create_pr.py · scripts/
finalize_report.py · scripts/
jira_client.py · scripts/
patch.py · scripts/
prepare_report.py · scripts/
report.py · scripts/
report_contract.py · scripts/
report_types.py · scripts/
repository_resolver.py · scripts/
scan.py · scripts/
start.py · scripts/
test_backport.py · scripts/
test_close.py · scripts/
test_create_pr.py · scripts/
test_patch.py · scripts/
test_report.py · scripts/
test_report_optimization.py · scripts/
test_scan_ext.py · scripts/
test_start.py · scripts/
test_verify_ext.py · scripts/
verify.py · scripts/
backport.md · skills/
close.md · skills/
controller.md · skills/
downstream-verification.md · skills/
patch.md · skills/
pr.md · skills/
report.md · skills/
scan.md · skills/
start.md · skills/
validate.md · skills/

SKILL.md (first lines)

# CVE Fix Workflow Orchestrator

## Quick Start

1. If the user invoked a specific command (e.g. `/patch`, `/pr`), read `commands/{command}.md` and follow it.
2. Otherwise, read `skills/controller.md` to load the workflow controller and begin with `/start`.

If a step fails or produces unexpected output, stop and report the error to the
user. Do not advance to the next phase. Offer to retry the failed step or
escalate.

For principles, hard limits, safety, and escalation rules, see `guidelines.md`.

From flightctl/ai-workflows, MIT.

Signals

Stars: 10
Forks: 17
Open issues: 3
Last commit (this folder): Oct 11, 2026 (26 days ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/flightctl/ai-workflows
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from flightctl

Done for you

Rather not set it up yourself?

Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.

See how we build AI agents →Read the case studies

Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.

launches shipped: 50+; launches shipped
media placements: 500+; media placements
founders on every account: 2; founders on every account

Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block

Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.

Get cve-fix running in your business

Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.

Need help deploying cve-fix?

Call Get help

Cite this page

cve-fix skill. Agent Mart. https://agentmart.dev/skills/flightctl-cve-fix (last updated 2026-10-24)

Need help deploying cve-fix?

Install

About

Reviews

Permissions

Network hosts it talks to 5

Files it touches

What's inside

More from flightctl/ai-workflows

Signals

Details

More from flightctl

Rather not set it up yourself?

Get cve-fix running in your business