Cognition releases skills for coding agents to patch vulnerable runtimes

Cognition’s repository provides skills for PHP, Node.js and self-managed GitLab. Skills are instructions stored in Markdown files for a coding agent to follow. The project supports agents that read SKILL.md files, including Devin, Claude Code and Cursor. Its workflow inventories repositories without editing, then asks the user which repositories to patch. This makes repository selection an explicit decision before changes begin.

The PHP instructions show why inventory matters: they record deployment channels, image pins, test coverage and uncertainty, and list repositories that could not be searched. For distribution packages, the agent must inspect the vendor’s changelog or advisory; the upstream version string alone does not establish whether a fix was backported. Changing Composer’s PHP requirements does not select the deployed runtime.

Cognition’s announcement also separates a proposed change from an effective repair. Developers review each pull request’s test results and risk label, then merge and deploy. The fix takes effect only after deploying the new build. Validation remains limited by test coverage. Managed runtimes are reported for provider action, while appliances and Electron applications are flagged for vendor updates rather than patched in place.

MarkTechPost covered the plugin and linked Cognition’s documentation.