agentsclimarketplace

Druid vulnerability fix

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-gemini-3.1-flash-lite-preview/fix-security-bug/druid-vulnerability-fix

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install
npx -y skills add cxcscmu/SkillLearnBench --skill druid-vulnerability-fix

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

How to fix the Apache Druid JavaScript sampler vulnerability. Use this skill when patching Druid code to block arbitrary JavaScript execution.

SKILL.md

1.2 KB, 203 tokens by cl100k_base, as published. Nobody here has run it

Druid JavaScript Sampler Vulnerability Fix

Overview

The vulnerability allows authenticated users to execute arbitrary code via the /druid/indexer/v1/sampler endpoint by passing a malicious JavaScript payload with an empty key "" in the JSON spec.

Fixing Strategy

  1. Identify the affected component: The JavaScriptConfig or related validation logic in Druid's processing module is responsible for the JavaScript filter.
  2. Restrict access: Ensure that the JavaScript filter is properly guarded and cannot be bypassed by empty keys or other malformed JSON structures.
  3. Validate payload: Add strict validation to the sampler configuration that prevents arbitrary code injection via the function property.

Patching Workflow

  1. Locate the responsible class (likely JavaScriptFilter or JavaScriptConfig).
  2. Implement robust input sanitization and validation.
  3. Generate a diff/patch file in /root/patches/.
  4. Apply the patch to /root/druid/.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.