Cognition releases free agent skills that patch flaws from this week

Cognition released the Devin Vulnerability Fixes plugin as open source. It has three agent skills with the MIT licence. They work on PHP, Node.js and self-managed GitLab systems that remote code execution flaws hit this week. Cognition gave no test results and no number of systems with a patch.

How it works

Each skill does one task. One skill finds the systems that the flaws hit, one patches them and one tests the patch. The agent then opens one pull request for each code repository. A pull request is a code change that a person can examine before it goes live.

The proof

The source gives no test results. It does not tell how many systems the plugin gave a patch or how much time a patch uses.

What is not known

The source does not name the flaws. It does not tell if the plugin works with agents other than Devin. It does not tell how much inspection by a person each pull request gets.

Insight: A free skill can pull companies toward one agent

Cognition gives the skills with the MIT licence, but the plugin is for the Devin agent of Cognition. Hack The Box released a test in 2026 that checks an agent again when the models change. This reads as a move to make one agent the usual tool for fast patches. The agent that companies use first can keep the work. Test each such agent before you use it.