patch Skill
Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, INCIDENTS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified vuln-pipeline patch ladder; static-analysis input gets a per-finding patch subagent + independent rev Published by anthropics in defending-code-reference-harness.
Decision snapshot
Is this a fit?
Security review, Documentation, Data analysis, Design and media
Compatibility not yet detected.
Permission behavior not yet detected.
Copy skill directory
2 months ago · NOASSERTION license
No specific cautions were detected. Review the source and requested permissions before installing.
What is patch Skill?
Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, INCIDENTS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified vuln-pipeline patch ladder; static-analysis input gets a per-finding patch subagent + independent rev Published by anthropics in defending-code-reference-harness. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement. See how SkillIndex evaluates profiles.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Documentation
- Data analysis
- Design and media
- Security review use cases
Declared skill metadata
- Source file: .claude/skills/patch/SKILL.md
Allowed tools declared by source
These fields retain source and confidence evidence from the indexed SKILL.md.
Compatibility and setup
- Install or run with Copy skill directory
When to use patch Skill
- Use it for security review.
- Use it for documentation.
- Use it for data analysis.
- Use it for design and media.
Built with
Editorial notes
Source
- Creator: anthropics
- Repository: anthropics/defending-code-reference-harness
- Skill file: .claude/skills/patch/SKILL.md
What it does
Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, INCIDENTS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified vuln-pipeline patch ladder; static-analysis input gets a per-finding patch subagent + independent rev
Skill instructions
patch Third leg of the static pipeline (/vuln-scan → /triage → /patch). Turns a ranked list of verified findings into candidate diffs. The skill never applies a diff to the target repo. Output is inert text in ./PATCHES/ for a human to review and apply out-of-band — see docs/patching.mdreviewing-generated-patches. There is no --apply or --approve flag by design: the capability isn't present, so it can't be prompt-injected into use. Invoke with /patch <findings-path [--repo PATH] [--top N] [--id fNNN] [--model M] [--fresh]. Arguments (parse from $ARGUMENTS): - findings path (first positional, required): TRIAGE.json, VULN-FINDINGS.json, a pipeline results/<target/<ts/ directory, or any JSON the /triage ingest table recognizes. - --repo PATH: target codebase, read-only (default cwd). Required for static mode; the skill stops if cited files don't resolve under it. - --top N: patch only the N highest-severity true positives (static mode). - --id fNNN: patch only the finding with this id. -
Verified compatibility and discovery
Frequently asked questions
What is patch?
patch is a open-source AI agent skill with Copy skill directory. Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, INCIDENTS.json, or a vuln-pipeline results directory.
Who is patch best for?
patch is best for reusing agent instructions, scripts, and references, security review workflows, documentation workflows, data analysis workflows.
How do I install patch?
Install or run patch using Copy skill directory. Check patch for the latest setup command.
Is patch actively maintained?
patch may need a closer maintenance check before production use.
Project health auto-fetched from the source repository.
Maintain this resource?
Review this source-backed profile, send a correction with evidence, or link to it from your documentation. Claims verify your relationship to the project; profile facts still require source evidence and editorial review.
