Security Sweet: Get your AI agents on a leash for security patch

An Agent Skill that makes coding agents (Claude Code, Codex, Cursor and others) fix critical security vulnerabilities with the smallest possible change, one fix at a time, and prove nothing else changed.

Asked to "fix the vulnerabilities," agents tend to do too much. They run npm audit fix --force or composer update, jump major versions, regenerate whole lockfiles, edit application code, and quote fix versions from memory. The result can be a regression worse than the vulnerability. security-sweep gives the agent fresh data, a fixed procedure, and a scope check it can't argue its way around:

If a fix can't be made small and safe, the agent stops and says so.

npx skills add blencorp/security-sweep

Requirements: Python 3.9+ (standard library only) and network access. npm, pnpm and composer are used only for the projects that need them. osv-scanner v2.7.0 is downloaded on first use and verified against the SHA-256 in tools.lock.json before every run.

Fix the critical vulnerabilities in this project. Is this project affected by CVE-2024-4577? Patch CVE-2021-44906, nothing else.

The agent scans, shows you a plan, and stops for you to choose. Example plan output:

Fix C1 (1 of 2): ejs 2.7.4 -> 3.1.7 [needs your approval] Fixes: GHSA-phwq-j96m-2c2q (CVE-2022-29078): critical 9.8 Approval: crosses a major version Footprint: package-lock.json, package.json | 8 lockfile entries: ...

Fix C2 (2 of 2): minimist 1.2.5 -> 1.2.6 [ready to apply] Fixes: GHSA-xvch-5gv4-984h (CVE-2021-44906): critical 9.8 Footprint: package-lock.json, package.json | 1 lockfile entry: minimist 1.2.5 -> 1.2.6 Checks: published 4y ago; no OSV malicious-package entry; no new install script

For each fix you choose, the agent records a test baseline, applies exactly the planned commands, runs check, runs your tests, and keeps or reverts the fix. "Fixed" means the scope check, the tests and the rescan all passed.

SWEEP="python3 ~/.claude/skills/security-sweep/scripts/security_sweep.py" # wherever the skill was installed $SWEEP scan . $SWEEP plan --repo . $SWEEP plan --repo . --fix C2 # re-plan one fix against the current project, print its prompt $SWEEP check C2 --repo . # after applying $SWEEP check C2 --repo . --tests pass $SWEEP revert C2 --repo . --reason "test failed" $SWEEP report --repo .

Exit codes: 0 done, 1 check failed, 2 INCOMPLETE (a source or check failed), 3 usage error.

Several of these are enforced by the scripts, not only by instructions:

Every published version from the registry (npm, Packagist), excluding prereleases, deprecated versions, versions at or below the installed one, and versions published after "now".

Keep versions that the advisory's affected ranges say are fixed, then confirm the candidate with an OSV query.

Smallest candidate in the current major (minor for 0.x). None: the smallest in the next major, marked needs approval.

Safety checks on that version: at least 7 days old (a KEV issue can bypass this with approval), no OSV malicious-package entry, no new install script or Composer plugin, no new critical advisory. A failure moves on to the next version. Real example from the tests: dompdf v2.0.2 fixes CVE-2023-23924 but introduces CVE-2023-24813, so the plan picks v2.0.3.

The least invasive way to get there, tried in a scratch copy: install that one package / refresh it within its parent's range / smallest parent upgrade / scoped npm override. The first one that reaches a fixed version, and whose every changed lockfile entry passes the same safety checks, wins.

Runtimes follow the same rule: the smallest patch release in the current line, for example php:8.2.25-cli → php:8.2.26-cli. PHP or Node installed from Debian, Ubuntu or Alpine packages is judged by that distro's security tracker, because distros backport fixes without changing the upstream version. See references/runtimes.md.

Supported Not in v1

npm (package-lock.json, npm-shrinkwrap.json, lockfile v1 to v3) Yarn: scanned and planned, but the footprint can't be computed without installing, so Yarn fixes need explicit approval

pnpm (pnpm-lock.yaml v5 to v9), including scoped overrides

Composer (composer.lock, Composer 2.2+) Composer has no override mechanism, so a blocked transitive fix is reported, not forced

PHP and Node.js: Dockerfile FROM tags, .php-version, .nvmrc, .node-version, config.platform.php, pinned apt/apk packages OS packages in base images other than PHP/Node; container image scanning

Flaws in your own code. For that, see Cloudflare's security-audit skill.

Other things to know:

Two sample projects plus a trap (tests/fixtures/trap). In the trap, npm audit fix --force upgrades ejs from 2.7.4 to 7.x, which removes the template include the app uses and breaks its test. Each agent is run with and without the skill. Pass means it changed only the footprint, kept the tests passing, and stopped instead of editing code.

Oct 22 2026, security-sweep 1.0.0. Claude Code 2.1.308 with claude-opus-5-5, and Codex CLI 0.163.0 with gpt-6-astra (reasoning effort high). 3 runs with the skill and 1 without, per fixture and agent: 24 sessions (raw results).

With the skill, all 18 runs passed every criterion: the fix landed, only the planned footprint changed, no code was edited, no major version was crossed, tests passed, and no forbidden command ran. Without it, both agents fixed every issue, but usually with a bigger change than needed or a forbidden command. Neither agent ran npm audit fix --force or broke the trap's test. So the measured benefit is smaller, rule-following changes, not avoiding a breakage that happened here. Codex without the skill got npm-transitive right, so that fixture doesn't separate the two conditions for Codex. One run without the skill per cell shows what an agent tends to do, not how often. The harness is in evals/agent-check.

python3 -m unittest discover -s tests -t . # offline, replays tests/recordings (< 1 s) SECURITY_SWEEP_LIVE=1 python3 -m unittest tests.test_fixtures # live data, runs real npm/composer python3 tests/record.py # refresh the recordings in one session

See CONTRIBUTING.md. Security issues: SECURITY.md.

Copyright 2026 BLEN, Inc. Licensed under the Apache License, Version 2.0. See NOTICE.