snyk-batch-fix

Snyk Batch Fix

Overview

Fixes a batch of code vulnerabilities that were pre-scanned by the Secure at Inception hook. No discovery scan is needed -- vulnerability data (file, line, type, description) is provided in the input. This command is designed for in-development code and does NOT prompt for a PR.

Workflow: Parse → Group → Fix → Validate → SCA (if applicable) → Summary

Invocation: This command is typically invoked automatically by the Secure at Inception stop hook via followup_message, not by the user directly. The stop hook passes a markdown table of pre-scanned vulnerabilities.

---

Phase 1: Parse Input

No scan is needed. The vulnerability data is already provided in the input table.

Step 1.1: Parse Vulnerability Table

Parse the markdown table from the input. Each row contains:

• #: Row number
• Severity: critical, high, medium, low
• ID: Snyk vulnerability ID (e.g., javascript/PT, python/SQLi)
• Title: Human-readable name (e.g., "Path Traversal")
• CWE: CWE identifier (e.g., CWE-22) or - if unavailable
• File: Relative path to the affected file
• Line: Starting line number of the vulnerability
• Description: Snyk's explanation of the issue

Step 1.2: Group Vulnerabilities

Group the parsed vulnerabilities for efficient fixing:

1. Group by file -- fix all vulns in one file before moving to the next
2. Within each file, group by vulnerability type (ID) -- same vuln type gets the same fix pattern
3. Sort files by highest severity -- fix the most critical files first
4. Within each file, sort by line number descending -- fix from bottom to top to avoid line shifts

Step 1.3: Document Targets

## Batch Fix Plan
- **Total vulnerabilities**: [count]
- **Files affected**: [count]
- **Vulnerability types**: [list of unique IDs]

| File | Vuln Types | Count | Highest Severity |
|------|-----------|-------|-----------------|
| [file1] | [IDs] | [n] | [severity] |
| [file2] | [IDs] | [n] | [severity] |