Patchbot — Security skill for Claude Code
Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR.
How to install Patchbot
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open PrismorSec/patchbot and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Patchbot does
Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled Managed Agents deployment.
Alternatives in Security
- Claude Code Security Review — An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities 3.9k ★
- Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★
- Mcp-scan (Invariant Labs) — MCP security scanner with proxy mode for real-time scanning without infrastructure changes 1.9k ★
README
patchbot
**Vulnerability scanning with your scanners, your threat feeds, and a coding agent that opens the fix PR.**
[](https://pypi.org/project/patchbot/) [](https://pypi.org/project/patchbot/) [](https://github.com/PrismorSec/patchbot/actions/workflows/ci.yml) [](LICENSE) [](#github-actions)
patchbot inventories the packages in your repository, matches them against any threat feed, accepts findings from any scanner, and fixes what it finds. When a version bump is enough, it bumps. When the bump breaks the build, it hands the failure to a coding agent. It re-scans before opening each pull request.
Run it as a CLI, as a GitHub Action, or as a scheduled [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) deployment with no CI involved.
Why patchbot
| Dependabot / Renovate | Trivy / Grype alone | patchbot | |
|---|---|---|---|
| Bring your own threat feed (private advisories, OSV format) | no | no | yes |
| Bring your own scanner (any tool that emits SARIF / Trivy / Grype JSON) | no | n/a | yes |
| Version bump + lockfile regeneration with no model call | yes | no | yes |
| Fixes that need code changes (breaking major bump, failing tests) | no | no | yes, agent tier |
| Re-scan before every PR | no | no | yes |
| Agent runs off the CI runner; secrets stay out of the sandbox | no | no | yes, Managed Agents |
| Works without CI (scheduled, any git host) | no | no | yes |
Installation
pipRelated Skills
Harden Deps
Deployment hardening step 3 — run ecosystem-native vulnerability audit (full tree AND production-only, so ship
Managed MCP Doctor
Audit Claude Code MCP governance drift, catch when allowedMcpServers no longer covers managedMcpServers (2.1.2
Global Agent Rules
Standing rules file for coding agents on web apps: schema protection, security, GDPR, SEO and a tiered pre-dep
Collomia
Collomia is a provider-neutral agentic coding agent for the terminal. Every model-proposed action passes throu
Check
by rygwdn - Performs comprehensive code quality and security checks, featuring static analysis integration, se
Claude Security Research Skill
AI-powered security research assistant for Claude Code — structured assessment workflows, tool orchestration,
Related Agents
Sec Security Auditor
Security auditor who performs vulnerability scanning, security reviews, and threat assessments. Use this agent
Kavach Intel
KAVACH threat-intelligence specialist. Runs a 3-tier adaptive sweep of published advisories (CVE/GHSA/OSV/NVD)
Code Security Auditor
Comprehensive security analysis and vulnerability detection for codebases. Specializes in threat modeling, sec
