Is fix-plan safe to install?

SaferSkills independently audited fix-plan (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/tridentchain-security/skills/fix-plan/SKILL.md · 1 file

plugins/tridentchain-security/skills/fix-plan/SKILL.md2.3 KB · Markdown

description: Generate an EPSS/KEV-prioritised remediation plan from a scan. Returns the top findings ranked by real-world exploitation risk with copy-paste upgrade commands, semver-jump risk classification (PATCH/MINOR/MAJOR), and a recommendation per package. Use when the user asks for "what should I fix first", "remediation plan", "how do I patch this", or "fix script".

Fix plan

When the user asks for a remediation plan, fix recipe, or "what should I patch first":

Run a scan first (use scan or scan-full per scope). If a recent .tridentchain-out/scan-report.json exists, you may reuse it.
From raw_summary.affected_components, build a prioritised plan:

Sort by EPSS score descending — the user wants the actively-exploited ones first.
For each finding, capture: package name, current version, fix version, ecosystem, CVE IDs, EPSS score, KEV status.

Present the plan as a table or numbered list. For each line include:

Risk badge: URGENT if KEV-listed OR EPSS > 0.5; HIGH if EPSS > 0.1; INFO otherwise.
Semver jump: PATCH (e.g., 5.0.5 → 5.0.6), MINOR (5.0.5 → 5.1.0), or MAJOR (5.x → 6.x). MAJOR bumps need user review.
Exact command the user can copy-paste:
npm: cd <manifest_dir> && npm install <pkg>@<fix_version>
pip: pip install --upgrade '<pkg>>=<fix_version>'
Homebrew (system): brew upgrade <pkg>

After the plan, suggest the user re-run validate-fixes once the patches are applied — this closes the loop and verifies the CVEs are actually resolved.

Important constraints

Never apply the commands yourself. Present the plan; let the user run it. Auto-applying dependency upgrades is the user's decision.
Flag MAJOR semver bumps explicitly. They often introduce breaking changes; do not group them with PATCH bumps.
Group by manifest. If there are multiple package.json files or multiple requirements.txt in the project, separate the commands per directory.

CLI fallback (no MCP)

tridentchain-security --scan project --project-path . --output-dir .tridentchain-out
# Open the EPSS-prioritised remediation report:
open .tridentchain-out/scan-remediation-epss.html

The HTML report already shows the EPSS-ranked remediation queue with per-package fix commands.

fix-plan— agent skill

Is fix-plan safe to install?

Fix plan

Important constraints

CLI fallback (no MCP)

Audit the pieces. Scan the whole. Decide.