Agent Skills › Tracer-Cloud/opensre › operating-github-security-fixer

operating-github-security-fixer

GitHub

用于修复 GitHub 安全与质量告警（如 Dependabot、CodeQL）的专用技能，支持自动补丁生成及可选的 PR 创建。

integrations/github/tools/security_fix/SKILL.md Tracer-Cloud/opensre

Trigger Scenarios

用户请求修复 GitHub 安全或质量问题处理代码扫描或依赖漏洞告警

Install

npx skills add Tracer-Cloud/opensre --skill operating-github-security-fixer -g -y

More Options

Non-standard path

npx skills add https://github.com/Tracer-Cloud/opensre/tree/main/integrations/github/tools/security_fix -g -y

Use without installing

npx skills use Tracer-Cloud/opensre@operating-github-security-fixer

指定 Agent (Claude Code)

npx skills add Tracer-Cloud/opensre --skill operating-github-security-fixer -a claude-code -g -y

安装 repo 全部 skill

npx skills add Tracer-Cloud/opensre --all -g -y

预览 repo 内 skill

npx skills add Tracer-Cloud/opensre --list

SKILL.md

Frontmatter

{
    "name": "operating-github-security-fixer",
    "tools": [
        "fix_github_security_alert"
    ],
    "description": "Use when the user asks OpenSRE to fix GitHub security and quality issues, Security and quality page findings, Code Quality standard findings, Dependabot alerts, code-scanning or CodeQL alerts, vulnerable dependencies, repo security issues, or to fix findings and optionally open a pull request."
}

operating-github-security-fixer

Use fix_github_security_alert for GitHub security remediation requests, not github_cli or shell_run.

Rules:

Dependabot, code-scanning/CodeQL alerts, and Code Quality standard findings are supported.
Secret-scanning alerts are refused by the tool; tell the user to rotate or revoke the secret first.
For a broad repo request, omit alert_number and use alert_type="auto" so the tool selects one open supported security or quality finding by severity.
If the user says "hey fix the security issues" without a repo, omit owner and repo; the tool uses the current checkout's GitHub origin.
For GitHub /security/code-scanning pages or CodeQL/code-scanning backlog requests, pass alert_type="code_scanning".
For GitHub /security/quality pages or quality backlog requests, pass alert_type="code_quality".
The tool fixes findings itself: built-in fixers first, then an auto-detected coding agent CLI. Never add coding-agent advice, CLI names, or install commands beyond what the tool's error text already says.
If the tool returns response_text, output exactly that text and stop.
If no automatic patch is produced, keep the reply to one short line from error; do not say "next steps", add numbered options, list example commands, or ask a broad follow-up question.
Set open_pr=true only when the user asks to open, raise, create, or ship a pull request.
With open_pr=true and a named repository, omit workspace for an isolated checkout. Local-only fixes use the configured workspace; an explicit checkout must match the target repository.
The tool runs one alert per call. Do not loop over multiple alerts unless the user explicitly asks to continue after the first result.
Report the result from summary, changed_files, branch_name, and pr_url.