patch Skill
Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified vuln-pipeline patch ladder; static-analysis input gets a per-finding patch subagent + independent reviewer and is wri Published by anthropics in defending-code-reference-harness.
What is patch Skill?
Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified vuln-pipeline patch ladder; static-analysis input gets a per-finding patch subagent + independent reviewer and is wri Published by anthropics in defending-code-reference-harness. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Documentation
- Data analysis
- Design and media
- Security review use cases
Technical details
- Install or run with Copy skill directory
When to use patch Skill
- Use it for security review.
- Use it for documentation.
- Use it for data analysis.
- Use it for design and media.
Built with
Editorial notes
Source
- Creator: anthropics
- Repository: anthropics/defending-code-reference-harness
- Skill file: .claude/skills/patch/SKILL.md
What it does
Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified vuln-pipeline patch ladder; static-analysis input gets a per-finding patch subagent + independent reviewer and is wri
Skill instructions
patch Third leg of the static pipeline (/vuln-scan → /triage → /patch). Turns a ranked list of verified findings into candidate diffs. The skill never applies a diff to the target repo. Output is inert text in ./PATCHES/ for a human to review and apply out-of-band — see docs/patching.mdreviewing-generated-patches. There is no --apply or --approve flag by design: the capability isn't present, so it can't be prompt-injected into use. Invoke with /patch <findings-path [--repo PATH] [--top N] [--id fNNN] [--model M] [--fresh]. Arguments (parse from $ARGUMENTS): - findings path (first positional, required): TRIAGE.json, VULN-FINDINGS.json, a pipeline results/<target/<ts/ directory, or any JSON the /triage ingest table recognizes. - --repo PATH: target codebase, read-only (default cwd). Required for static mode; the skill stops if cited files don't resolve under it. - --top N: patch only the N highest-severity true positives (static mode). - --id fNNN: patch only the finding with this id. -
Explore related resources
Frequently asked questions
What is patch?
patch is a open-source AI agent skill with Copy skill directory. Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, or a vuln-pipeline results directory.
Who is patch best for?
patch is best for reusing agent instructions, scripts, and references, security review workflows, documentation workflows, data analysis workflows.
How do I install patch?
Install or run patch using Copy skill directory. Check patch for the latest setup command.
Is patch actively maintained?
patch may need a closer maintenance check before production use.
Auto-fetched from GitHub.
