Security Agent Local Fix

Use this skill for local Codex-first remediation from ~/security-agent. The local path clones the target repo, creates a security branch, fixes Maven dependency CVEs, runs build/test verification, and optionally pushes a PR.

Preflight

Run from the central workspace. If any command fails, use $security-agent-setup.

cd ~/security-agent
test -f .env
.venv/bin/edi-security-agent --version

Use only the pip-installed CLI/UI from ~/security-agent. Do not call repo-local Python modules, Azure fetcher scripts, or files from edi-security-agent-controller. If setup needs Artifactory credentials, route to $security-agent-setup for the opt-in chat credential forwarding flow or own-Terminal fallback. If plain pip3 or a global edi-security-agent works but .venv/bin/edi-security-agent is missing, do not use the global install. Explain the pip-scope mismatch and route to $security-agent-setup so the package is installed into ~/security-agent/.venv.

Preconditions

• Azure Defender config must be present: AZURE_REGISTRY_NAME, AZURE_ASSESSMENT_KEY, and preferably AZURE_SUBSCRIPTION_ID.
• codex --version should work for Codex-first execution.
• GITHUB_TOKEN and GITHUB_ORG are required only for apply mode, PR creation, or CCA workflows.
• OPENAI_* is optional fallback when Codex is unavailable or fails.

Workflow

1. List first unless the user already provided exact repo/severity:

.venv/bin/edi-security-agent defender list --repo <repo> --severity high --fixable-only

2. Default to dry-run for first pass:

.venv/bin/edi-security-agent defender fix --repo <repo> --severity high --executor codex

3. Use apply mode only when the user explicitly asks to push/create PRs:

.venv/bin/edi-security-agent defender fix --repo <repo> --severity high --executor codex --apply

4. Use --git-repo <github-repo> when the Defender/ACR repository name differs from the GitHub repository name.
5. For multiple repos, use repeated --repo flags or --all; use explicit azure-repo=github-repo mappings for overrides.

What The Local Agent Does

• Runs mvn dependency:tree to identify direct, BOM-managed, transitive, or internal edi-* dependency sources.
• Uses Codex CLI as the autonomous local agent for pom.xml, build, and test repair.
• Falls back to UAIS/OpenAI JSON patch flows only when configured and needed.
• Commits, pushes, and opens PRs only in apply mode.

Safety

• Never push directly to main/develop.
• Keep dry-run as the default when the user's intent is unclear.
• Do not bypass the installed CLI by running repo-local scripts or Python modules.
• Do not store credentials or copied Security Platform cookies.
• If Maven build/test errors are environmental, report them instead of forcing code changes.