Cognition’s Free Skills Patch This Week’s PHP, Node and GitLab Flaws

A remediation workflow, packaged as three plain SKILL.md files that any agent can read.

@Marktechpost reports that Cognition open-sourced its Devin Vulnerability Fixes plugin. It holds three agent skills: fix-php-vuln, fix-node-vuln and fix-gitlab-vuln. They target PHP2Shell, the Oct. 21 Node.js security release and the self-managed GitLab bug CVE-2026-110264.

Cognition’s blog lays out five steps. The agent first runs a read-only inventory of Dockerfiles, base images, distro packages, CI, Helm, Terraform and more. It then asks which repositories to patch, and flags anything riskier than a patch bump. It confirms every tag, digest and checksum against the official source before editing.

Next it runs your tests on the current version for a baseline, then again inside the new production image. Last, it opens one pull request per repository with before and after versions, test results, a risk label and a rollback plan.

To install it in any agent that reads skills, run npx skills add CognitionAI/devin-vuln-fixes. In the Devin CLI, the blog gives devin plugins install CognitionAI/devin-marketplace#plugins/devin-vuln-fixes. Then ask in plain words, such as “Please fix my PHP vulnerability.”

@Marktechpost lists Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI and OpenCode among the agents it runs in. It notes the trade-off: there is no published fix-rate benchmark, and validation is only as good as your test suite.