Cognition announced its open-source Vulnerability Fixes plugin on Oct. 22, 2026, for Devin and compatible coding agents. Its published repository lists three skills: fix-php-vuln, fix-node-vuln and fix-gitlab-vuln, the last for self-managed GitLab. In its blog post, Cognition says the PHP and Node.js projects released security updates on Oct. 21 addressing vulnerabilities that could allow remote code execution.
Approval before patching
According to Cognition's workflow, the agent starts with a read-only inventory of repositories it can access, looking for runtimes in places such as container images, packages and CI configurations. A user selects which repositories to patch before changes begin. The agent is then meant to check patch targets, run tests before and after an update, and open one pull request per repository with results and a rollout and rollback plan. Cognition's README describes the same approval gate for all three skills.
Cognition provides installation instructions for Devin and other coding tools that read Agent Skills files. An agent needs git, a shell and repository read access; builds and tests also require Docker and access to an image registry or package mirror. Cognition advises users to review skills before running them because some agents run with their full permissions. Its also tells users to review, merge and deploy the new build for a fix to take effect, and warns that the agent can validate only what the tests cover.
