Fix Finding

Before choosing paths or saving retained output, read ../../references/artifact-storage.md and follow its storage policy.

Objective

Turn a current security finding into a minimal, validated code change. If the code is already safe, prove that and report that no change was needed.

Classify the current state from evidence, close the broken security boundary, preserve legitimate behavior, and pass the checks required by the selected verification mode. Prefer the smallest repository-native change that meets those requirements.

Verification Mode

Use standard verification unless the caller explicitly selects verificationMode: static. The selected mode applies throughout this skill, including delegated reviews and workbench stages; pass it to every delegated agent.

In static mode, assess source and diff evidence only. Do not install dependencies or run builds, tests, reproducers, or the application, including when validation instructions request them. Repository-reading tools remain available. State that runtime checks were not performed; do not count them as passed or require them for this assessment. Missing runtime tooling alone is not a blocker, but a material gap in the source evidence still requires blocked.

Patch Contract

Before editing, inspect the affected implementation, its direct callers, nearby helpers, and relevant existing tests. Establish from repository evidence:

• the attacker-controlled input and concrete source-to-sink path or broken control
• the security invariant and narrowest shared enforcement boundary
• legitimate behavior, APIs, error semantics, and compatibility constraints that must remain
• the closest existing implementation, validation, and error-handling precedents