What is fix-security-issue?

A workflow for implementing a security fix that has already been reviewed and approved as a real concern. It uses the review's remediation plan and works from a GitHub issue.

Remediating reviewed security issues in GitHub repositories, either from a specified issue or from issues marked for implementation.

It connects a documented security finding to its planned code change, so fixes are based on an earlier review rather than a new guess.

How NVIDIA/OpenShell configures Claude Code and Codex

About the project

OpenShell is a runtime for autonomous AI agents that executes them in sandboxed environments governed by declarative policies. It is used to restrict agents' access to files, credentials, data, and network resources, and the catalogue includes skills and workflows for operating and contributing to it.

NVIDIA/OpenShell · 21,172 stars · on GitHub · docs.nvidia.com

Reuse

Borrowing it

Nothing to install: this file belongs to NVIDIA/OpenShell. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/NVIDIA/OpenShell/main/.agents/skills/fix-security-issue/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/NVIDIA/OpenShell

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/nvidia/openshell/fix-security-issue/github.svg)](https://agentmods.dev/skills/nvidia/openshell/fix-security-issue)

Your own site

<a href="https://agentmods.dev/skills/nvidia/openshell/fix-security-issue"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/fix-security-issue/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/nvidia/openshell/fix-security-issue"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/fix-security-issue.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 23 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 584 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

Snyk warn 7 Sept 2026
NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00023	$0.00584
Opus 5.5	$0.00009	$0.00234
Sonnet 5.5	$0.00005	$0.00117
Haiku 4.5	$0.00002	$0.00058

Measured 6d ago against content hash 1324ca1b649b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

fix-security-issue scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/fix-security-issue/SKILL.md · 23 lines

What it actually says

Fix Security Issue

Use this skill after an authorized review-security-issue review identifies an actionable concern. Follow SECURITY.md; do not disclose vulnerability details in a public issue. A direct user request to fix a specific reviewed issue authorizes implementation. For unattended work, inspect current state:* label descriptions, maintainer assignments, and comments to verify that remediation is authorized. Do not infer approval from a state that only records technical validation.

Fetch the issue and its comments with gh issue view <id> --json number,title,body,state,labels,comments. Follow Label Discovery in CONTRIBUTING.md and confirm this is a security issue; resolve unclear meanings before interpreting authorization. Find the review marked > **🔒 security-review-agent** and its remediation plan. If the review is missing or found the issue not actionable, stop and report that result.
Verify the review against current code. Adapt the plan when code has changed, and record material deviations. Check for an existing owner, branch, or PR.
Create a fix branch or worktree following Branch Names in CONTRIBUTING.md, preserving unrelated changes and disclosure boundaries. Implement the smallest safe fix and add regression tests for the security boundary. Avoid logging secrets or adding public exploit detail.
Follow the verification guidance in CONTRIBUTING.md. Run format, lint, compile or type checks, and regression tests for the affected security boundary and dependent components, plus the relevant E2E lane for sandbox or policy changes. Broaden verification when the fix spans components or a concrete risk remains; do not require unaffected Rust or SDK suites solely to create a signed-off commit or PR.
Follow create-github-pr and use Closes #<id> for the reviewed issue. Every PR from this issue-backed remediation workflow must close its own issue; split multi-PR remediations into separate issues in the authorized security workflow. Keep the PR description appropriately scoped to its disclosure venue.

Begin any fix comments with > **🔧 security-fix-agent**. Do not change human disposition or introduce agent:* workflow labels.

For first-party security-sensitive crypto, use openshell-crypto and extend its facade/backend contracts when needed. Follow the crypto architecture for compatibility, failure handling, and explicit coverage exceptions.

When changing crypto dependencies, run mise run rust:deny:policy, including its dependency-boundary regression fixtures. Review any deny.toml wrapper change against the documented exception scope; an existing allowance does not authorize new security-sensitive operations outside the facade.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago Changed · +2 lines 1324ca1b649b
18d ago Changed · +2 lines dc5e2c051701
1mo ago Changed da76b4b06743
1mo ago Changed · -304 lines · -47 tokens per session 6a766a67dedd
2mo ago Changed · +2 lines 04ab09d266db
2mo ago First seen · 321 lines · 70 tokens per session scan A 1d95042bfb50

Subscribe to this mod's changes

fix-security-issue is a skill published in the GitHub repository NVIDIA/OpenShell (21,172 stars, last pushed yesterday), licensed Apache-2.0. It adds 23 tokens to every session and 584 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.