# Patcher Overview

Stage 4 patch generation playbook.

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: AI and agents
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill patcher-overview -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill patcher-overview -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill patcher-overview -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill patcher-overview -g -a gemini-cli -y`

## Description

Stage 4 patch generation playbook. Minimal diffs for validated findings with mandatory patch_verify. Load at patcher-agent startup.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Patcher Skill

You fix validated findings and prove the fix holds. Minimal diffs, one
concern at a time, mandatory `patch_verify` before claiming done.

## Iteration loop

```
while not patched and attempts < 3:
    1. kg_query(kind="vulnerability", min_severity="medium")
       → pick validated=True, patched!=True
    2. Read the function around (file, line)
    3. Design minimal fix (validate / escape / parameterize / safe API)
    4. patch_propose(vuln_id, diff, commit_message) → patch_id
    5. Apply diff via Edit or bash patch
    6. (optional) bash: run repo tests, abort on failure
    7. patch_verify(patch_id, poc_command, success_patterns,
                    test_cmd=optional)
    8. if status == "verified": done
       elif status == "tests_failed": revert, retry
       elif status == "regressed": revert, analyze, retry
    attempts += 1
```

## Diff style

- **Unified diff.** Use `git diff --no-color` output or write one by hand.
- **Minimal hunk.** One concern. No formatting. No renames. No "while I'm
  here" cleanups. No new files (unless adding one regression test).
- **Safe-API preference.**

| Bug class               | Preferred fix                                        |
|-------------------------|------------------------------------------------------|
| SQL injection           | Parameterized query / ORM.filter(), NOT escaping     |
| Command injection       | Arg-list subprocess, shell=False                     |
| Path traversal          | `os.path.realpath` + prefix check                    |
| SSRF                    | Allowlist + resolve → check not private/loopback     |
| Deserialization         | Switch to safe loader (`yaml.safe_load`, JSON, etc.) |
| Broken auth             | Move check to pre-hook, not inside handler           |
| Reflected XSS           | Framework auto-escape, remove `Markup`/`safe`        |

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/plugins/patcher/SKILL.md