tech-wag

Vigilant Guacamole — Security skill for Claude Code

Security community

AI Code Review Agent (with Auto-Fix) Connects to GitHub PRs, runs parallel Security / Performance / Test-coverage review agents (Claude + LangGraph), and opens a second PR with the actual fix applied.

How to install Vigilant Guacamole

This entry records only its repository, not the path inside it, so there is no exact command to give. Open tech-wag/vigilant-guacamole and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Vigilant Guacamole does

Alternatives in Security

Second Opinion — Trail of Bits security skill for second opinion 3.7k ★
Skill Coverage Audit — Trace codepaths in diffs, map against tests, auto-generate missing coverage — use before shipping PRs 2.8k ★
Audit Test — Audit test quality 63 ★

README

AI Code Review Agent (with Auto-Fix)

Connects to GitHub PRs, runs parallel Security / Performance / Test-coverage review agents (Claude + LangGraph), and opens a second PR with the actual fix applied — no back-and-forth comments.

Status

Step	What	State
1	FastAPI webhook receiver (HMAC verification, dedup, dispatch)	✅ Done
1a	Run-history persistence (SQLite) + dashboard UI	✅ Done
2	GitHub client: fetch PR diff, parse into hunks	✅ Done
3	LangGraph StateGraph: parallel Security/Performance/Test agents	✅ Done
4	Fix Agent: generate patch, open fix PR	✅ Done
5	Demo repo + seed script for the Instagram clip	✅ Done

All five steps are implemented. See [Known limitations](#known-limitations) for the gaps worth knowing about before relying on this beyond a demo.

Architecture

**Request flow** — a webhook comes in, gets validated and recorded, control returns to GitHub before any slow work happens, and the background task runs the full pipeline: fetch the diff (Step 2), review it with three parallel Claude agents (Step 3), and — if they found anything — generate and open a fix PR (Step 4):

sequenceDiagram
    participant GH as GitHub
    participant WH as Webhook handler
(app/webhooks)
    participant DB as SQLite
(runs.db)
    participant BG as Background task
    participant API as GitHub API
(PyGithub, worker thread)
    participant LG as LangGraph
(3 parallel agents)
    participant FIX as Fix agent

    GH->>WH: POST /webhooks/github (signed payload)
    WH->>WH: verify HMAC-SHA256 signature
    WH->>WH: dedup by X-GitHub-Delivery
    WH->>WH: filter: action type, draft PR
    WH->>DB: create_run() → status=queued
    WH->>BG: schedule run_review_pipeline()
    WH-->>GH: 202 Accepted {run_id}
    BG->>DB: update_run() → status=running
    BG->>API: fetch_pr_files() → per-file .patch
    API-->>BG: files (or DiffTooLargeError / GitHubAPIError)
    BG->>BG: parse_pa