# patch-generator

Turns one security finding into a staged change inside a throwaway clone, ready to be handed over as a patch file.

- subagent · `type=agent` · Claude Code · ★ 44770
- Author: Anthropic · official Anthropic repository
- License: LicenseRef-Proprietary · policy=link-only · description only; the file stays with the author
- Source: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/patch-generator.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/patch-generator

## What it does

This subagent never edits your working tree. It runs in a scratch clone that the fix job creates, checked out at a chosen patch base — detached, not on a branch. That base can sit ahead of the commit the report was built from, so a recorded line number is a hint at best; the flagged code is found through its snippet and symbol instead.

The change has to address the root cause and stay narrow: only what closing that single finding requires. No drive-by refactors, no dependency bumps. If the honest fix alters observable behaviour, `summary` must say which behaviour changed. When the code at this revision is no longer exploitable, or the call belongs to the owner, nothing is touched and `summary` explains why.

Before returning, the agent runs `git add -A` once inside the workspace so the staged diff covers every changed byte, new files included. Nothing is committed or pushed. An independent verifier inspects the diff and runs the tests, and the patch only leaves the run on a PASS. Dispatch comes from the fix job; there is no manual invocation. The agent installs nothing on its own — no packages, no toolchain — and uses the project's own test command. A suite that will not run in the environment gets reported, not worked around.

## Install

### Claude Code (native platform)

1. **Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install claude-security@claude-plugins-official
```

2. **Manually: put the files in place**
- File: `.claude/agents/patch-generator.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/patch-generator.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/patch-generator.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/patch-generator.md

## When to use it
- close one security finding without disturbing the rest of the code
- produce a patch for review instead of committing straight to the repo
- find the vulnerable spot by snippet when the line number has drifted
- check whether the finding still reproduces at the current revision
- flag a behaviour change in summary for the verifier

## Example prompts
- Fix the finding in the `FINDING` block inside `WORKSPACE` and leave the change staged
- Locate the flagged code by snippet and symbol, treat the line number as a hint
- If the finding does not reproduce at this revision, change nothing and explain in `summary`

## Similar
- [multi-agent-review](https://affpapa.org/en/nevibecode/commands/multi-agent-review.md) — command · ★ 41823
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [anthropics/claude-plugins-official](https://affpapa.org/en/nevibecode/by/anthropics/claude-plugins-official.md) — 145 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md