From Harness
Find and fix high and critical application dependency CVEs across all non-archived GitHub repositories available to the authenticated gh CLI user. Use when the user asks to address, remediate, audit, patch, or report severe CVEs/security advisories across many repos, including cloning missing repos, scanning dependencies and GitHub Actions, making dependency changes, testing, committing, pushing, merging to main after validation, cleaning branches, and producing a Markdown stdout report.
How this skill is triggered — by the user, by Claude, or both
Slash command
/harness:address-cvesThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Remediate high and critical application dependency vulnerabilities across repositories discovered with `gh`. Work repo-by-repo, preserve user changes, validate before merging, and report exactly what happened.
Remediate high and critical application dependency vulnerabilities across repositories discovered with gh. Work repo-by-repo, preserve user changes, validate before merging, and report exactly what happened.
Read REFERENCE.md when choosing scanners, upgrade strategies, or validation commands for a specific ecosystem.
gh; include private repos; exclude archived repos.~/workspace.npx, uvx, pipx run, go run, etc.) over installing scanner tools into projects.main, push main, then delete local and remote security branches only when validation passes.Confirm gh auth status works. If not, stop and ask the user to authenticate.
Build the repo set from the authenticated account and its orgs:
gh api user --jq .login.gh repo list <login> --limit 1000 --json nameWithOwner,isArchived,isPrivate,url,defaultBranchRef.gh org list --limit 1000; for each org, list repos with the same gh repo list fields.nameWithOwner.isArchived == false.For each repo, ensure it exists under ~/workspace/<repo-name> unless a matching clone already exists. Prefer ~/workspace/<owner>/<repo> if multiple owners have the same repo name.
For each repo:
main unless the repo metadata says otherwise.security/fix-high-critical-cves from the updated default branch.Do not overwrite user work. If the branch already exists and contains unmerged local work, stop for that repo and report it.
Before changing dependencies:
Use scanner output plus package manifests/lockfiles to determine whether each finding is runtime or dev-only when possible.
Fix high/critical findings in this order:
Keep changes scoped to vulnerability remediation and required migrations. Do not perform unrelated refactors.
After changes:
Validation passes only when high/critical findings are fixed and no new regressions appear.
When validation passes:
fix: address high and critical CVEs.security/fix-high-critical-cves.If validation fails:
Print a Markdown report to stdout. Include:
Keep the report factual. Do not write a report file unless the user explicitly asks.
npx claudepluginhub rubenglez/harness --plugin harnessGuides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.