How this skill is triggered — by the user, by Claude, or both
Slash command
/rhoai-security-reviewer:bug-fix-attemptThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Attempt to produce a fix for a Jira bug by editing midstream (opendatahub-io) repository clones, producing both a machine-readable JSON result and a human-readable markdown summary.
Attempt to produce a fix for a Jira bug by editing midstream (opendatahub-io) repository clones, producing both a machine-readable JSON result and a human-readable markdown summary.
You are working in an isolated workspace under src/ (within the output directory) that contains shallow clones of the relevant midstream (opendatahub-io) repositories. These are the repos where RHOAI fixes are contributed.
architecture-context/ for understanding component design — but never edit files in architecture-context/.data-science-pipelines/ is a clone of opendatahub-io/ai-pipelines).Your prompt will include a Workspace Info section listing:
Your primary output is a JSON file conforming to this schema:
{
"issue_key": "RHOAIENG-XXXXX",
"root_cause_hypothesis": "The controller does not handle nil ConfigMap data, causing a nil pointer dereference when ...",
"affected_files": [
{
"path": "pkg/controller/reconciler.go",
"repository": "opendatahub-io/odh-model-controller",
"change_description": "Add nil check before accessing ConfigMap data map"
}
],
"fix_description": "Add a nil guard on the ConfigMap.Data field before iterating over entries.",
"patch": "diff --git a/pkg/controller/reconciler.go ...",
"confidence": "medium",
"risks": [
"The nil ConfigMap case may be intentional in some deployment scenarios"
],
"blockers": [
"Could not verify against a live cluster"
],
"recommendation": "ai-fixable",
"target_repo": "opendatahub-io/odh-model-controller",
"upstream_consideration": null,
"self_corrections": [
{
"after_iteration": 2,
"failure_trigger": "lint-error",
"mistake_category": "unused-import",
"what_went_wrong": "Added an import for 'fmt' that was not used in the final code",
"what_was_changed": "Removed the unused fmt import",
"files_modified": ["pkg/controller/reconciler.go"],
"was_original_approach_wrong": false
}
]
}
root_cause_hypothesis: string explaining what's wrong and whyaffected_files: array of objects with path, repository, and change_descriptionfix_description: string summarizing what the fix doespatch: string containing the diff/patch in unified diff format (the phase runner will replace this with the real git diff from your edits)confidence: one of "low", "medium", "high"risks: array of strings describing what could go wrongblockers: array of strings describing reasons the fix might not workrecommendation: one of:
"ai-fixable" — the AI produced a code fix"already-fixed" — the bug is already fixed in the current codebase"not-a-bug" — this is a feature request, enhancement, RFE, or by-design behavior"docs-only" — the fix is a documentation change, not a code change"upstream-required" — the fix must happen in an upstream repo outside the RHOAI midstream"insufficient-info" — not enough information in the bug report to attempt a fix"ai-could-not-fix" — the AI tried but could not produce a working fixtarget_repo: string — the midstream org/repo this patch targets (e.g., "opendatahub-io/odh-dashboard")upstream_consideration: string or null — if the fix should be proposed upstream first, explain where and why (e.g., "Fix should be proposed at kserve/kserve first as this is upstream of opendatahub-io/kserve"). Set to null if not applicable.self_corrections: array (optional, retry only) — when retrying after validation failure, record what you got wrong. Each entry has:
after_iteration: integer — which iteration this correction follows (e.g., 2 means "corrected after iteration 1 failed")failure_trigger: one of "lint-error", "build-error", "test-failure", "setup-failure"mistake_category: one of "unused-import", "missing-import", "syntax-error", "type-error", "nil-handling", "api-misuse", "incomplete-change", "wrong-file", "test-expectation", "formatting", "logic-error", "dependency-issue", "other"what_went_wrong: string — free-text explanation of the mistakewhat_was_changed: string — free-text description of the correctionfiles_modified: array of file paths changed in the correctionwas_original_approach_wrong: boolean — true if the fundamental approach changed, false if it was a minor fixUnderstand the bug:
architecture-context/ (referenced in the context map)Root cause analysis:
Evaluate fix strategies (before writing code):
Implement the fix:
upstream_consideration whether the fix should go upstream first and whytarget_repo to the midstream org/repo (e.g., opendatahub-io/odh-dashboard)Self-review:
5b. Prevent regression:
risks and explain what manual verification would catch a regression.validated: true — those are the ones that will actually run6b. Report self-corrections (retry only):
## Validation Feedback section, this is a retry after a failed validationself_corrections array in your JSON output with one entry describing what you correctedafter_iteration to the iteration number shown in the feedback header (e.g., if the header says "Iteration 2", set after_iteration to 2)failure_trigger based on what type of validation failed: "lint-error" for lint/formatting failures, "build-error" for compilation failures, "test-failure" for test assertion failures, "setup-failure" for environment setup failuresmistake_category to the best match from the enum (e.g., "unused-import" if you left an unused import, "type-error" for type mismatches, "incomplete-change" if you missed updating another call site)what_went_wrong and what_was_changed descriptionsfiles_modified in this correctionwas_original_approach_wrong to true only if you fundamentally changed your approach, false for minor fixesself_corrections in the JSON"ai-fixable" — you produced a working code fix. Use this when you edited files and believe the patch addresses the root cause."already-fixed" — after reading the current codebase, the bug appears to already be fixed in the midstream code. Explain in fix_description what code already handles the reported issue."not-a-bug" — the reported behavior is by design, a feature request, enhancement, or RFE. Explain in fix_description why this isn't a defect."docs-only" — the issue is a documentation gap, not a code defect. No code change is needed; describe the doc change in fix_description."upstream-required" — the fix must happen in an upstream repo (e.g., kserve/kserve, kubeflow/training-operator) that is above the RHOAI midstream. Set upstream_consideration to explain where and why."insufficient-info" — the bug report lacks enough detail (steps to reproduce, error messages, environment info) to identify the root cause. List what's missing in blockers."ai-could-not-fix" — you attempted a fix but could not produce a working solution. Explain what you tried and what blocked you in blockers.root_cause_hypothesis and fix_description with your best analysis.Write two files in the output directory specified in the prompt header:
fix-attempt.json — the JSON object described abovefix-attempt.md — a human-readable rendering:# Fix Attempt: {KEY}
## Target Repository
[midstream org/repo]
## Root Cause Hypothesis
[Explanation of what's wrong and why]
## Affected Files
| File | Repository | Change Description |
|------|-----------|-------------------|
| [path] | [repo] | [what changes] |
## Fix Description
[What the fix does and why it addresses the root cause]
## Patch
```diff
[The actual diff/patch]
[If applicable: where the fix should go upstream first and why. Otherwise: "N/A"]
[Brief explanation of the recommendation]
### Important Rules
- **DO NOT edit** anything under `architecture-context/` — it is read-only reference material.
- **DO edit** files in the cloned midstream repos in your working directory.
- Read the actual source code before proposing changes. Do not guess at file contents.
- If you cannot find the relevant source code, document what you looked for and recommend `ai-could-not-fix`.
- Write output files to the **Output Directory** specified in the prompt header, **not** to `issues/` or your current working directory.
npx claudepluginhub ikredhat/skills-registry --plugin rhoai-security-reviewerGuides creation and editing of skills using test-driven development with pressure scenarios and subagents to verify agent compliance.
Guides reception of code review feedback: verify before implementing, avoid performative agreement, push back with technical reasoning when needed.
Estimates input tokens and offers response depth choices (brief to exhaustive) before answering. Activates on explicit token/depth/length requests.