security-patch-advisor

Security Patch Advisor

Overview

This skill analyzes security vulnerabilities and provides comprehensive remediation strategies without automatically modifying code. It offers multiple remediation approaches with detailed trade-off analysis, code examples, and implementation guidance for vulnerabilities categorized by CWE (Common Weakness Enumeration) and severity.

When to Use This Skill

Use this skill when you need:

• Remediation strategies for detected security vulnerabilities
• Safer API alternatives for insecure code patterns
• Design-level security improvements
• Multiple remediation approaches with trade-offs
• Code examples showing before/after fixes
• Prioritized remediation plans based on severity and impact
• Security best practices for specific vulnerability types

Trigger scenarios:

• After running static analysis tools (SAST)
• After security audits or penetration testing
• When reviewing code for security issues
• When planning security improvements
• After vulnerability disclosure or CVE reports

Core Workflow

1. Vulnerability Analysis

When presented with a security vulnerability, analyze:

Context Gathering:

• Vulnerability type and CWE classification
• Severity level (Critical, High, Medium, Low)
• Affected code location and scope
• Current implementation details
• Attack vectors and exploitation scenarios
• Business impact and data sensitivity

Questions to Consider:

• What is the root cause of the vulnerability?
• What data or systems are at risk?
• What are the prerequisites for exploitation?
• Are there existing security controls?
• What is the attack surface?

2. Remediation Strategy Development

Provide multiple remediation approaches:

Strategy Components:

1. Primary Remediation (recommended approach)
2. Specific code changes required
3. Safer API alternatives
4. Security controls to implement
5. Validation and sanitization logic

1. Alternative Approaches
2. Different implementation strategies
3. Framework-specific solutions
4. Defense-in-depth measures
5. Compensating controls

1. Design-Level Changes
2. Architectural improvements
3. Security patterns to adopt
4. System-level mitigations
5. Infrastructure changes

For Each Strategy, Include:

• ✅ Benefits and security improvements
• ⚠️ Trade-offs and limitations
• 📊 Implementation complexity
• ⚡ Performance impact
• 🔧 Required dependencies or tools
• 📚 Relevant security standards (OWASP, CWE, NIST)

3. Code Examples

Provide concrete before/after examples:

Example Structure:

### Vulnerable Code
[Show the insecure code with clear vulnerability markers]

**Vulnerability:** CWE-XXX (Name)
**Risk:** [Explain the security risk]
**Attack Example:** [Show how it could be exploited]

### Remediated Code (Approach 1)
[Show the fixed code with security improvements]

**Changes:**
- [List specific changes made]
- [Explain security mechanisms added]

**Trade-offs:**
- ✅ [Benefits]
- ⚠️ [Limitations or considerations]

### Alternative Remediation (Approach 2)
[Show alternative fix if applicable]

**Trade-offs:**
- ✅ [Benefits]
- ⚠️ [Limitations or considerations]

4. Implementation Guidance

Provide step-by-step implementation instructions:

Guidance Should Include:

1. Prerequisites
2. Required libraries or dependencies
3. Configuration changes needed
4. Environment setup

1. Implementation Steps
2. Ordered list of changes
3. Code modifications required
4. Testing procedures

1. Verification
2. How to verify the fix works
3. Security testing recommendations
4. Regression testing considerations

1. Deployment Considerations
2. Backward compatibility
3. Migration strategy
4. Rollback plan

5. Prioritization and Risk Assessment

Help prioritize remediation efforts:

Prioritization Factors:

• Severity: CVSS score, exploitability, impact
• Exposure: Public-facing vs internal, attack surface
• Data Sensitivity: PII, credentials, financial data
• Ease of Exploitation: Skill level required, available exploits
• Business Impact: System criticality, user impact
• Remediation Effort: Development time, testing requirements

Priority Levels:

• P0 (Critical): Immediate action required (active exploitation, critical systems)
• P1 (High): Fix within days (high severity, exposed systems)
• P2 (Medium): Fix within weeks (moderate risk, mitigating controls exist)
• P3 (Low): Fix in next release cycle (low risk, defense in depth)

Vulnerability Categories

Buffer Overflow Vulnerabilities

• CWE-120: Buffer Copy without Checking Size
• CWE-121: Stack-based Buffer Overflow
• CWE-122: Heap-based Buffer Overflow
• CWE-787: Out-of-bounds Write

Common Remediations:

• Use safe string functions (strncpy, snprintf)
• Implement bounds checking
• Use memory-safe languages or libraries
• Enable compiler protections (stack canaries, ASLR)

Injection Vulnerabilities

• CWE-89: SQL Injection
• CWE-78: OS Command Injection
• CWE-79: Cross-Site Scripting (XSS)
• CWE-91: XML Injection
• CWE-94: Code Injection

Common Remediations:

• Use parameterized queries/prepared statements
• Implement input validation and output encoding
• Use safe APIs instead of shell execution
• Apply Content Security Policy (CSP)
• Use ORM frameworks with built-in protections

Insecure Deserialization

• CWE-502: Deserialization of Untrusted Data

Common Remediations:

• Use data-only formats (JSON, XML)
• Implement integrity checks (HMAC signatures)
• Whitelist allowed classes
• Avoid deserializing untrusted data

Authentication & Authorization

• CWE-287: Improper Authentication
• CWE-306: Missing Authentication
• CWE-862: Missing Authorization
• CWE-798: Hard-coded Credentials
• CWE-522: Insufficiently Protected Credentials

Common Remediations:

• Implement multi-factor authentication
• Use secure session management
• Implement proper authorization checks
• Use environment variables or secret management
• Hash passwords with bcrypt/Argon2

Cryptographic Issues

• CWE-327: Use of Broken Cryptography
• CWE-328: Weak Hash
• CWE-330: Insufficient Randomness
• CWE-326: Inadequate Encryption Strength

Common Remediations:

• Use modern algorithms (AES-256, SHA-256, RSA-2048+)
• Use cryptographically secure random number generators
• Implement proper key management
• Use authenticated encryption (GCM, CCM)

Memory Safety

• CWE-416: Use After Free
• CWE-476: NULL Pointer Dereference
• CWE-415: Double Free
• CWE-401: Memory Leak

Common Remediations:

• Use smart pointers (C++)
• Nullify pointers after free
• Use memory-safe languages
• Enable AddressSanitizer for testing

Path Traversal & File Handling

• CWE-22: Path Traversal
• CWE-73: External Control of File Name
• CWE-434: Unrestricted Upload of Dangerous File Type

Common Remediations:

• Validate and sanitize file paths
• Use whitelists for allowed paths/extensions
• Implement proper access controls
• Store uploads outside web root

Output Format

Structure your remediation advice as follows:

## Vulnerability Summary
- **Type:** [CWE-XXX: Name]
- **Severity:** [Critical/High/Medium/Low]
- **Location:** [File:Line or Component]
- **Impact:** [Brief description of security impact]

## Risk Analysis
[Explain the security risk, attack vectors, and potential impact]

## Recommended Remediation (Primary)
[Detailed description of the recommended fix]

### Code Example
[Before/after code showing the fix]

### Implementation Steps
1. [Step 1]
2. [Step 2]
...

### Trade-offs
- ✅ [Benefits]
- ⚠️ [Considerations]

## Alternative Approaches

### Alternative 1: [Name]
[Description and code example]

**Trade-offs:**
- ✅ [Benefits]
- ⚠️ [Considerations]

### Alternative 2: [Name]
[Description and code example]

**Trade-offs:**
- ✅ [Benefits]
- ⚠️ [Considerations]

## Design-Level Improvements
[Architectural or system-level changes to consider]

##