patch

Name: patch
Author: tomevault-io

Productivity Community

Repo stars 0
Author updated Live
Author repo skills-registry

Fluxly profile Facts only: domain, agents, trust score, runtime, permissions and network

Domain: Productivity
Compatible agents: Claude Code
Cursor
Cline
Codex
Windsurf
Gemini CLI

+20
Trust score: 88 / 100 · community maintained
Author / version / license: @tomevault-io · no license declared
Token usage: Lean
Setup complexity: Guided setup
External API key: Not required
Operating systems: Unspecified (assume cross-platform)
Runtime requirements: No special requirements
Permissions: Read-only
Write / modify
Shell exec
Network behavior: External requests
Install commands: 26 variants

Profile is derived at build time from SKILL.md and install vectors. Subject to drift from author intent.

Heads up: 未限定 allowed-tools，默认拥有全部工具权限。

Output preview patch.preview

---
name: patch
description: Propose a code patch for a finding. Produces a unified diff against the current HEAD plus a shor…
category: productivity
runtime: no special runtime
---

# patch output preview

## PART A: Task fit
- Use case: Propose a code patch for a finding. Produces a unified diff against the current HEAD plus a short rationale, written back as a finding note so the analyst can review, adjust, and open a PR themselves. The skill never pushes to the remote. Use when this capability is needed..
- Inputs: target material, constraints, expected output, and acceptance criteria.
- Evidence boundary: follow “Workspace / What to do / Refusing to patch” and do not present inference as author intent.

## PART B: Execution result
- **01** The card summarizes the use case; runtime output centers on “Propose a code patch for a finding. Produces a unified diff against the current HEAD plus a short rationale, written back as a finding note so the analyst can review, adjust, and open a PR themselves. The skill never pushes to the remote. Use when this capability is needed.”.
- **02** When the source has headings, the agent prioritizes “Workspace / What to do / Refusing to patch” so the result follows the author’s structure.
- **03** Typical output includes task judgment, concrete steps, required commands or file edits, validation, and follow-up options.
- **04** Risk context follows the fingerprint: read files, write/modify files, run shell commands; may access external network resources; usually needs no extra API key.

## Running Rules
- read files, write/modify files, run shell commands; may access external network resources; usually needs no extra API key.
- Validate with a small sample before expanding scope.
- Return the result, validation criteria, and next iteration options.

SKILL.md SKILL.md

---
name: patch
description: Propose a code patch for a finding. Produces a unified diff against the current HEAD plus a shor…
category: productivity
source: tomevault-io/skills-registry
---

# patch

## When to use
- Propose a code patch for a finding. Produces a unified diff against the current HEAD plus a short rationale, written b…
- Use it when the task has clear inputs, repeatable steps, and validation criteria.

## What to provide
- Target material, scope, expected result, and forbidden changes.
- Whether network, commands, file writes, or external services are allowed.

## Execution rules
- Organize steps around “Workspace / What to do / Refusing to patch” and keep inference separate from source facts.
- read files, write/modify files, run shell commands; may access external network resources; usually needs no extra API key.
- Validate with a small sample before expanding the task.

## Output requirements
- Return the deliverable, key evidence, validation method, and next action.
- Mark missing information as unknown; do not invent commands, platforms, or dependencies.

Evidence boundary and execution chain

The author source anchors workflow facts; repository files anchor sources and commands; Fluxly only adds fit, limitations, and quality judgment.

skill "patch" {
  input      -> user goal + target files + boundaries + acceptance criteria
  context    -> Workspace / What to do / Refusing to patch
  rules      -> SKILL.md triggers / order / output contract
  runtime    -> no special runtime | read files, write/modify files, run shell commands | may access external network resources
  guardrails -> usually needs no extra API key + small-sample validation + diff/log review
  output     -> copyable result + checklist + next iteration
}

Interpretation is structured for decision-making; original keeps the upstream SKILL.md unchanged.

Decide Fit First

Core job: Propose a code patch for a finding. Produces a unified diff against the current HEAD plus a short rationale, written back as a f…
Best fit: Use it when the task has reusable inputs, steps, and validation criteria rather than a one-off answer.
Avoid forcing it: If the source lacks commands, platform support, or external-service evidence, keep those fields unknown instead of guessing.

Design Intent

Structure: The skill is organized around “Workspace”, “What to do”, “Refusing to patch”, “Constraints”, showing how the author expects the agent to judge fit, collect context, and produce verifiable output.
Trigger evidence: Prioritize the author’s wording around when to use it, what context to collect, and what output shape to produce.
Evidence boundary: Author text states facts, repository files prove commands and paths, and Fluxly only adds fit, limits, and usage judgment.

How To Use It

Inputs: Provide target material, scope, expected result, forbidden changes, and validation method.
Invocation: Name patch directly; if the source includes slash commands, start with the command and then add task context.
Validation: Start small and check whether the result follows “Workspace / What to do / Refusing to patch” before expanding.

Boundaries And Review

Dependencies: It usually needs no extra API key, so start with a small validation task.
Permissions: Declared permissions include read / write / shell-exec; ask the agent to state file, command, and rollback boundaries before acting.
Quality bar: A useful result names the deliverable, evidence, and next action. Generic prose means the task needs tighter context.

patch

Propose a minimal code patch that fixes a confirmed finding. You are not shipping the fix; you are handing the analyst a starting diff and explaining what it does. The analyst reviews, edits if needed, and opens a PR by hand.

Workspace

./src — the repository at its current HEAD, on the default branch, writable
./context.json — has scrutineer.api_base, scrutineer.token, scrutineer.repository_id, scrutineer.finding_id (required; this skill only makes sense finding-scoped)
./report.json — write the patch + rationale here
./schema.json — shape of report.json

What to do

Read ./context.json. If scrutineer.finding_id is missing, write {"error": "no finding_id in context.json; patch is finding-scoped"} to report.json and exit 0.
Fetch the finding: GET {api_base}/findings/{finding_id} with Authorization: Bearer {token}. Read location, cwe, trace, boundary, validation, rating. These five together tell you where the sink is, what the vulnerable input flow looks like, and what dangerous behaviour you need to stop.
Inside ./src, edit files to fix the finding. Constraints:
- Minimal. Change only what the fix requires. Do not refactor surrounding code, rename variables, reformat unrelated lines, or upgrade dependencies unless the fix inherently requires it.
- In place. Fix the sink where it lives. If the finding's location is pkg/foo/bar.go:42, that is where the patch should land (or at the nearest layer where a guard is sensible — e.g. the input validator that feeds the sink).
- Consistent. Match the existing code style and idioms. If the codebase uses a specific sanitiser, validator, or helper for similar cases, reuse it. Do not introduce a new helper module for a one-off fix.
- Safe. The patch must not break the reproduction's documented legitimate behaviour — only block the dangerous path. If you cannot tell where the dangerous path diverges from legitimate use, stop and write an inconclusive report (see below).
- Include a test when practical. If the repo has a test suite that covers the vulnerable code path, add a regression test that would fail without your patch. If the repo has no tests, or the sink is in a place that is hard to cover, skip this and say why in rationale.
Once you have a working tree edit, generate a unified diff against HEAD:
```
cd src
git add -N .
git diff HEAD -- . > /tmp/patch.diff
```
Read /tmp/patch.diff and put its contents into report.json under the patch field. Do not commit; the diff is the artefact. If the diff is empty, something went wrong — do not write an empty patch. Write {"error": "patch produced no diff"} and exit 0.
POST a finding note summarising the patch: POST {api_base}/findings/{finding_id}/notes with:
```
{
  "body": "Proposed patch in scan #{scan_id}.\n\nFiles changed: ...\n\n{short rationale}\n\nApply with: `git apply` the diff from the scan report.",
  "by": "patch"
}
```
The note lives on the finding page; the full diff lives in report.json and is viewable on the scan page.
Do not PATCH any editable fields on the finding. Specifically:
- Do not set fix_commit — that field means a shipped upstream fix, not a proposal. The analyst sets it after their PR merges.
- Do not set fix_version — same reason.
- Do not touch status. Lifecycle transitions belong to the analyst.

Write ./report.json:

{
  "patch": "diff --git a/pkg/foo/bar.go b/pkg/foo/bar.go\n...",
  "rationale": "Short prose — two or three sentences. What the guard is, why it blocks the trace, what legitimate input it still lets through.",
  "files_changed": ["pkg/foo/bar.go", "pkg/foo/bar_test.go"],
  "base_commit": "<HEAD sha from ./src>",
  "tests_added": true,
  "notes": "Optional: anything the analyst should know — a second sink you spotted but didn't patch, a style choice you weren't sure of, a test you couldn't write."
}

base_commit is the HEAD sha the diff applies to. The analyst needs this to git am or git apply cleanly — if they rebased since the scan, they know the patch may not apply and can regenerate.

Refusing to patch

Write {"error": "...", "rationale": "..."} and exit 0 in any of these cases — do not ship a bad patch:

The finding prose is too thin (empty Trace, empty Validation). You need both to know where the sink is and what behaviour to stop.
The fix is architectural (e.g. "rewrite this whole module to not shell out") rather than localisable. A patch skill proposes a surgical fix; larger changes are an issue comment for the maintainer, not a diff.
The codebase is in a language or framework you cannot confidently edit without risking regressions. It is better to say so than to produce a plausible-looking but wrong patch.
The finding has already been fixed upstream. Check git log -- {location} — if a recent commit looks like it addressed the sink, surface the SHA in notes and refuse to duplicate.

Constraints

Do not push. Do not commit. Do not open a PR. The scrutineer workspace is ephemeral and isolated; your diff is the only thing that survives the scan.
Do not add dependencies unless the vulnerability genuinely requires one (e.g. a sanitiser library the codebase already uses elsewhere). New top-level deps in a patch almost always mean the fix is in the wrong place.
Do not edit the lockfile, go.sum, Gemfile.lock, package-lock.json, Cargo.lock, etc. unless you also changed the manifest that owns it. Stray lockfile churn makes diffs hard to review.
Do not touch files outside what the fix requires. CI config, docs unrelated to the fix, README — leave alone.

Source: alexandre-daubois/scrutineer — distributed by TomeVault.

Install command

One-click installPick a runner, click Copy, paste into your terminal, press enter

npx skills add tomevault-io/skills-registry/alexandre-daubois--scrutineer--patch -y

Open general install guide

View skill source

Works with

Claude Code
Cursor
Cline
Codex
Windsurf
Gemini
OpenCode
Roo Code
AAide
+Augment
GitHub Copilot
OpenClaw
KKiro
Junie
WWarp
Goose
Trae
Kilo Code
OpenHands
Amp
Zencoder
CContinue
AIAider
CodeBuddy
CodeGeeX
Replit Agent

Security audit

88 / 100

Community

未声明 license/许可。
未声明 version。
未限定 allowed-tools，默认拥有全部工具权限。

Metadata

Source: github
tomevault-io/skills-registry
中文

More by @tomevault-io

Category & tags

Category Productivity

Decide Fit First

Design Intent

How To Use It

Boundaries And Review

patch

Workspace

What to do

Refusing to patch

Constraints

Discussion