remediation-generator·codegen·active

Remediation Generator

Drafts a code or config change for each finding. Specific to the framework, language, and proxy in use. No 'investigate further' filler.

SARAcursorclaude-codetrigger · agent

Drafts a concrete code or config change for each finding — specific to the framework, language, and proxy in use. No "investigate further" filler.

When this skill fires

·Payload Mutator orOWASP Probe Library confirms a finding and Evidence is captured

·An engineer asks SARA to "give me the fix" for a specific finding

·A pre-merge gate has flagged a vulnerability that needs remediation in the same PR

What "concrete" means

→The output is a diff or a configuration change the engineer can apply, review, and merge. Not a description. Not a list of options. One specific change.

If multiple remediations are valid, the generator picks the one most consistent with the rest of the codebase and notes the alternative as a comment.

Framework awareness

The generator detects the language, framework, and proxy stack and produces remediations idiomatic to each:

SQL injection

·Node + Knex → switch to parameterized query API

·Python + SQLAlchemy → use ORM-bound queries

·Go + database/sql → ? placeholders, no fmt.Sprintf

·Java + JDBC → PreparedStatement

Missing auth

·Express → middleware on the route

·Spring → @PreAuthorize annotation

·Rails → before_action filter

·Go HTTP → middleware in the chain

Missing security headers

·nginx → add_header directives in the right block

·Caddy → header directive

·Cloudflare → page rule or worker

·Application-layer fallback if no proxy is reachable

Vulnerable dependency

·npm → package.json version bump + npm audit fix annotation

·pip → requirements.txt pin + minimum-supported-version note

·maven → pom.xml version bump

What gets generated

A pull request body with:

·The specific file(s) and line(s) to change

·The exact diff

·A test that proves the fix works (usingEvidence Capture to replay the original attack)

·A reference to the finding ID and the CWE / CVE it addresses

·An estimate of regression risk (low / medium / high) based on which code paths the change touches

→The test is non-negotiable. A fix without a regression test is half a fix.

Confidence + override

If the generator can't pick a single remediation with high confidence (e.g. the codebase is inconsistent, or the fix has architectural implications), it surfaces the tradeoffs and asks the engineer to decide. The default isn't a bad guess — it'sno guess.

What it produces

For each finding:

·A diff

·A regression test

·A PR description with finding ID, CWE/CVE, risk estimate

→Remediation Generator output is what closes a finding. Without it, SARA is just a scanner.

Related · codegen

Step Definition Generator

step-def-generator

Converts Gherkin steps into Cucumber/TypeScript step definitions. Wires parameters, expression types, and shared world state automatically.

Page Object Generator

page-object-generator

Inspects DOM (live or via spec) and emits typed Page Objects with stable selectors and high-level actions. Enforces single-responsibility per object.

Locator Strategist

locator-strategist

Picks the most stable selector for a target element — role-based first, label-based next, test-id last. Avoids brittle CSS class chains.

API Test Generator

api-test-generator

Reads OpenAPI / GraphQL schemas and emits contract + integration tests. Handles auth, pagination, idempotency, and rate-limit assertions.

Test Data Factory

test-data-factory

Synthesizes realistic test data — names, addresses, payment cards, medical records, account numbers — with deterministic seeds and PII safety.

Assertion Expander

assertion-expander

Augments thin Gherkin Then-clauses with additional assertions: response codes, side-effects, audit log entries, downstream events.