Run3 druid javascript vulnerability locator

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill run3_druid-javascript-vulnerability-locator

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Systematic identification of all Apache Druid components utilizing JavaScript to ensure comprehensive patching of CVE-2021-25646.

1.5 KB, 295 tokens by cl100k_base, as published. Nobody here has run it

Search for JavaScript Config Consumers: Identify all classes that depend on JavaScriptConfig. Use grep or an IDE to find usages of the JavaScriptConfig class, specifically looking for constructor parameters or fields annotated with @JacksonInject.
Required Class List: Ensure the following classes (at minimum) are inspected for JavaScript execution logic and configuration injection:
- Filters: org.apache.druid.query.filter.JavaScriptDimFilter
- Aggregators: org.apache.druid.query.aggregation.JavaScriptAggregatorFactory
- Post-Aggregators: org.apache.druid.query.aggregation.post.JavaScriptPostAggregator
- Extraction Functions: org.apache.druid.query.extraction.JavaScriptExtractionFn
- Search Query Specs: org.apache.druid.query.search.JavaScriptSearchQuerySpec
- Broker Selection: org.apache.druid.server.router.JavaScriptTieredBrokerSelectorStrategy
- Worker Selectors: org.apache.druid.indexing.overlord.setup.JavaScriptWorkerSelectStrategy
Validation of Input Sources: For each identified class, verify if the JavaScriptConfig object is being passed via the constructor and if that constructor is annotated with @JsonCreator. If a parameter is meant to be injected by the system but lacks explicit protection, it may be susceptible to JSON-based overrides.