Neckr0ik Security Fixer

Security Fixer

Automatically fixes security vulnerabilities found by neckr0ik-security-scanner.

Quick Start

# Scan and fix in one command
neckr0ik-security-fixer fix /path/to/skill --auto
Interactive fix (confirm each change)
neckr0ik-security-fixer fix /path/to/skill
Generate .env.example only
neckr0ik-security-fixer env /path/to/skill

What This Fixes

Critical Issues (Auto-fixable)

| Issue | Fix Applied | |-------|-------------| | Hardcoded Secrets | Replaces with os.environ.get() + generates .env.example | | Shell Injection | Converts to subprocess.run() with shell=False | | eval/exec | Wraps with safe alternatives or flags for review |

High Issues (Auto-fixable)

| Issue | Fix Applied | |-------|-------------| | Prompt Injection | Adds sanitization wrapper | | Path Traversal | Adds pathlib validation |

How It Works

1. Runs security scan on target skill 2. For each vulnerability, generates fix 3. Applies fix automatically (with --auto) or prompts for confirmation 4. Creates .env.example with detected secret placeholders 5. Updates .gitignore to exclude .env

Example Fixes

Hardcoded API Key

Before:

api_key = "sk-abc123def456..."

After:

import os
api_key = os.environ.get("OPENAI_API_KEY")
if not api_key:
    raise ValueError("OPENAI_API_KEY environment variable required")

Generated .env.example:

OPENAI_API_KEY=your-key-here

Shell Injection

Before:

os.system(f"convert {filename} output.png")

After:

import subprocess
result = subprocess.run(
    ["convert", filename, "output.png"],
    capture_output=True,
    check=True
)

Prompt Injection

Before:

prompt = f"User says: {user_input}"

After:

import re
def sanitize_for_prompt(text: str) -> str:
    return re.sub(r'[<>\{\}\[\]\\]', '', text[:1000])
prompt = f"User says: {sanitize_for_prompt(user_input)}"

Commands

fix

neckr0ik-security-fixer fix  [options]
Options:
  --auto        Apply all fixes without prompting
  --dry-run     Show what would be fixed without making changes
  --backup      Create .bak files before modifying

env

neckr0ik-security-fixer env 
Generates:
  - .env.example (template with placeholders)
  - Updates .gitignore to exclude .env

report

neckr0ik-security-fixer report  --format json
Outputs a detailed fix report with:
  - Original vulnerable code
  - Fixed code
  - Files modified
  - Manual review items

Safety Features

See Also

# Scan and fix in one command
neckr0ik-security-fixer fix /path/to/skill --auto
Interactive fix (confirm each change)
neckr0ik-security-fixer fix /path/to/skill
Generate .env.example only
neckr0ik-security-fixer env /path/to/skill