Can AI Agents Fix Vulnerabilities Without Overstepping? Hands-On Review of Cognition's Open-Source Skill Pack

When GitLab's CVE-2026-110264 flooded security circles with a perfect CVSS score of 10.0, a more practical question surfaced: if you hand vulnerability remediation to a coding agent, how do you ensure it doesn't overstep its bounds, modify code it shouldn't, or miss deployment locations? Cognition's answer is a free, open-source vulnerability remediation skill pack—but it doesn't let the agent "figure it out on its own." Instead, it keeps human approval, testing, and rollback firmly in human hands.

The Vulnerability Storm: GitLab's Perfect-Score Flaw and Multi-Platform High-Risk Fixes

First, let's get clear on what needs fixing. According to the video content, GitLab's CVE-2026-110264 has a CVSS score of 10.0, placing it at the highest severity level. Meanwhile, PHP and Node.js also have multiple high-risk vulnerabilities to address.

PHP has two high-risk vulnerabilities, with CVE-2026-110264 scoring 9.2 on CVSS v4.0, affecting the 8.4.27 and 8.5.2 branches. The target fix versions are clearly listed. Node.js's update addresses 10 CVEs, 4 of which are High severity. CVE-200026 and 111497 involve broadly out-of-bounds write risks—this isn't something a routine dependency upgrade can paper over.

GitLab CE and EE have been affected since version 7.0, with fix targets spread across branches 18.11.1, 23, 19.0.130, and others, plus branches 19.1.109, 19.2, 19.4, and 19.5 corresponding to their respective fix versions. Once the version ranges and fix targets are laid out, the question becomes: who executes, how do they execute, and what happens if they get it wrong?

CVSS Scoring Mechanism: CVSS (Common Vulnerability Scoring System) is the industry-standard framework for assessing vulnerability severity. The current mainstream versions, v3.1 and v4.0, both use a 0.0–10.0 scoring range. Scores are calculated from a combination of dimensional metrics, including base metrics such as attack vector (network, adjacent, local, physical), attack complexity, required privileges, and user interaction, as well as impact metrics covering confidentiality, integrity, and availability. A score of 10.0 represents the highest severity level, typically meaning the vulnerability can be exploited remotely without authorization and causes complete system compromise. Understanding CVSS scoring helps teams quickly prioritize fixes when vulnerabilities emerge, but note that the score does not equate to actual risk—it must be assessed alongside factors like asset exposure and exploitation conditions.

Out-of-Bounds Write Risk: Out-of-bounds write is a classic type of memory safety vulnerability, where a program writes data beyond the boundaries of a buffer. These vulnerabilities commonly appear in languages with manual memory management like C/C++, where attackers can overwrite critical data in adjacent memory regions to achieve remote code execution or privilege escalation. Node.js relies on the V8 engine and numerous C++ extensions at its core, so CVEs involving out-of-bounds writes typically indicate high or even critical severity, since the exploitation barrier is relatively low and the consequences are severe. Fixing such vulnerabilities often requires upgrading the runtime version rather than simply applying a patch.

What the Skill Pack Actually Encapsulates: From Patch Generation to Auditable Process

The focus of Cognition's release isn't scanning algorithms—it's packaging remediation steps for PHP, Node.js, and self-hosted GitLab into three reusable skills. Put plainly, it's more like an emergency response protocol that can be handed to different coding agents for execution.

This product line extends from January to October 2026, with the direction shifting from agent governance toward auditable vulnerability remediation processes. The April 2026 one-click deployment, the October vulnerability research model, and the auditable remediation loop all follow the same thread. The skill pack teaches agents to do very specific things: read-only investigation, checking images, packages, versions, and component configurations, selecting repositories, and waiting for approval before modifying code. After approval, the agent verifies the official fix target before upgrading, then re-runs existing tests in a new production image.

The keyword throughout the entire process is "auditable"—every step must be visible and interruptible by humans, rather than the agent racing all the way to production.

SKMD and Coding Agent Compatibility: SKMD (Skill Markdown) is a markup format for describing executable agent skills, essentially an "operations manual" written for agents to read. It defines metadata such as the skill's name, applicable scenarios, execution steps, required permissions, and output format, enabling different coding agents to parse and invoke skills in a unified way. Cognition's skill pack is packaged in SKMD format, so only agents that support reading SKMD (such as Devon, Codex, and others) can integrate directly. This design decouples skills from agent platforms—the same skill description can be reused across multiple agents, reducing vendor lock-in risk. The compatibility scope of over 70 agents also suggests this format is becoming one of the de facto standards for agent skill distribution.

Human Approval Remains the Gatekeeper: How Testing and Rollback Stay in Human Hands

The most misunderstood aspect of the skill pack is whether it lets agents decide on production changes autonomously. The answer is no.

Stopping upon detecting a regression is a hard rule. After tests pass, the agent submits a separate PR (merge request) for each repository, with test results and a rollback plan attached.

Beyond the test results and rollback arrangements submitted with the PR, human approval remains the gatekeeper. In other words, the agent handles the grunt work and assembles the evidence, but humans give the final green light. Approval and testing reduce the risk of overstepping, but they cannot prove every fix is correct—remediation effectiveness is limited by test coverage, and there is currently no success rate data.

More practical boundaries lie in test and environment validation rigor: this depends on existing repository tests, hosted runtime infrastructure, and the fact that Electron applications are only flagged, not automatically patched. Security teams need to understand that this skill pack improves process auditability, not an absolute guarantee of remediation correctness.

Compatibility and Deployment Limitations: Legacy Runtimes and Installation Environments

Before integrating this skill pack, check whether your agents support it. It supports Devon, Codex, and other coding agents capable of reading SKMD, with compatibility spanning over 70 agents.

But while compatibility spans over 70 agents, NPX installation still requires Node.js 20, and the installation environment must meet requirements. More critically, PHP 8.1 and older, as well as Node.js 20 and older, have no corresponding official new-version fixes for this round—legacy runtimes have no matching new patches, and whether they can be integrated depends on the specific environment. This is a reminder to teams: vulnerability remediation isn't a mindless upgrade, and the cost of holding on to old versions may be greater than expected.

The three skills are free and open-source under the MIT license. After verifying licensing and approval/release standards, teams trying them out should start with a single repository, check test coverage, approval permissions, and rollback plans, then decide whether to expand to more projects.

What "No Patch for Legacy Runtimes" Means and How to Respond: Software runtimes such as PHP 8.1 and Node.js 20 stop receiving security updates once the official end-of-life (EOL) date passes, meaning no new fix versions will be released even when high-risk vulnerabilities are discovered. This means teams continuing to use legacy runtimes face a "no patch available" dilemma and can only reduce risk through compensatory measures such as upgrading to supported versions, network isolation, and adding a WAF. The skill pack's role in this scenario is limited—it can only verify official fix targets and execute upgrades, not conjure patches the vendor hasn't provided. Therefore, teams must inventory runtime version lifecycles before integration and prioritize EOL versions in upgrade plans, rather than relying on agents to "fix everything."

Conclusion: Auditable Process, But Not a Guarantee of Absolute Security

Cognition's skill pack turns vulnerability remediation into an approvable, verifiable, and rollback-capable process, but it cannot guarantee that fixes are always safe. For teams facing GitLab's perfect-score vulnerability and multi-platform high-risk CVEs, the value of this tool lies in bringing agents into a controlled process, not in outsourcing responsibility to them. Map out deployment locations and configurations first, then have humans guard the approval and rollback gates—that's how you truly cage the risk.