Devin agent skills that patch the GitLab CVSS 10.0, PHP and Node.js RCEs

The skills, named devin-vuln-fixes, are available on GitHub and are compatible with a wide range of coding agents, including Devin, Claude Code, Codex, Cursor, and GitHub Copilot. They are designed to follow a consistent workflow that begins with an inventory of vulnerable runtimes across a user's repositories.

The skills scan a variety of configuration and definition files, such as Dockerfiles, version files, CI configs, Helm charts, Terraform, Ansible, Chef, and Puppet. The goal is to produce a comprehensive table that lists each file, its current version, the pinning style used, whether it is for production or CI-only, its test coverage, and the agent's confidence in the finding.

A key feature of the skills is an approval gate. The agent will not make any changes until the user explicitly selects which repositories to patch. This ensures that no production code is altered without human oversight.

Once a target is confirmed, the agent checks to ensure the fixed tag, digest, or package actually exists before making any edits. It never guesses or assigns a version based on a simple version string comparison.

The skills then run tests both before and after the fix is applied. These tests are executed inside the newly built production image, not just on the host machine. This approach is intended to catch regressions and deprecation warnings that might be missed by host-side tests.

For each repository, the agent generates a single, focused pull request. This PR includes before and after comparisons, digests of the fixed artifacts, test results, a risk label, a rollout plan, and a rollback target.

Installation and usage

The skills can be installed using the Node.js-based npx skills CLI. The command npx skills add CognitionAI/devin-vuln-fixes will detect the agents installed on the user's machine and ask where to install the skills. Users can also specify agents directly or install the skills globally for all projects.

For agents that support plugin marketplaces, such as Claude Code, Codex, and Factory Droid, the skills can be added through their respective plugin interfaces. The skills are also compatible with Devin, which can discover them from a connected repository or from the .agents/skills/ directory.

Users can interact with the skills using plain language, such as asking an agent to "fix my PHP vulnerability" or patch the repos that are on a vulnerable Node version. The agent will then select the appropriate skill from its description. Alternatively, users can invoke the skills directly using slash commands like /fix-php-vuln or /fix-node-vuln.

The skills require the agent to have read access to the repositories it is scanning. For the build and test steps, it needs access to Docker and the image registry or package mirror used by the user's CI system.

Agent-neutral design and maintenance

The design of the skills is intentionally agent-neutral. They do not depend on a single agent's specific tools or configuration. For example, they avoid using the allowed-tools field, which can have different formats across agents, to ensure portability.

The skills are pinned to the security advisories from October 21, 2026. This ensures that the fixed versions are based on the most current information at the time of release. When a vendor ships a newer patch, the skills can be updated by bumping the metadata version in their frontmatter and running npx skills update.

The skills are open source, and users are encouraged to contribute changes or propose new skills through the project's CONTRIBUTING.md file. This community-driven approach aims to keep the tools effective and relevant as the software landscape and security landscape evolve.