Devin's New Plugin Skips Business Logic Code, Opens PRs Dedicated Exclusively for Vulnerability Patches

Cognition has open-sourced a new Devin plugin named Vulnerability Fixes. It addresses the most labor-intensive segment of security incident response: after a vulnerability is confirmed, teams need to map its impact across multiple repositories, modify code, run test suites, and finally submit patches for review. The plugin comes with 3 MIT-licensed agent skills covering PHP, Node.js and self-hosted GitLab deployments, specifically built for the critical RCE vulnerabilities disclosed this week. After the full workflow finishes, it will open one dedicated PR for each repository.

The core value of this tool lies in the PR generation step. Plenty of automation tools can flag which dependencies are problematic, but the real challenge is turning a fix into review-ready production changes. One PR per repository means developers can check the diff, run CI pipelines and decide the merge rhythm based on each individual codebase boundary. This is especially critical for teams running self-hosted GitLab, where deployment and configuration discrepancies are often far more complicated than a simple one-line version number update.

Devin acts as the execution layer in this workflow. Vulnerability scanning and alerting are still handled by your original toolchain, and this plugin fills the missing path from alert to ready-to-review fix PR: it first audits which deployments are affected, then applies patches, and then runs corresponding tests. All 3 skills are open-sourced under the MIT license, so the barrier to trial is very low, but you should never treat it as an unattended fully autonomous patching machine. PRs generated by the agent still require human review, especially for changes to dependency lock files, custom configurations and test coverage. For RCE vulnerability remediation, a passing test run never means the risk is fully eliminated.

The integration process is not complicated: connect the plugin to your Devin workflow, specify the target repository scope, let it finish the impact inventory first, then complete patching and testing repository by repository, and finally review the PRs it opens. Detailed installation and configuration instructions are available in the project documentation. For readers with a development background, this is equivalent to packaging all repetitive security remediation actions into a reusable agent skill. For general users, you can understand it as equipping the AI with a standardized vulnerability remediation checklist: it follows the checklist to complete all tasks, but you remain the person who signs off on the final changes.

Source: MarkTechPost, by Michal Sutter. Original Article Link