Fix a Lockpick finding

Before you start

Read findings with the Lockpick CLI or MCP when the user has connected it (npx lockpicks login, see the lockpick skill). Otherwise ask for a brief: on the run page, "Copy prompt to fix all" at the top covers every finding that needs attention, and "Copy fix prompt" on a card covers one. They paste the result to you. The copy menu can tailor the prompt for your agent, or copy a one-line CLI command that opens you with the prompt already loaded. For DNS findings (SPF, DMARC, CAA, DNSSEC, dangling subdomains) use lockpick-dns instead.

The flow

1. Read the finding

• With the MCP: lockpick_get_repair_brief for the run (no findingId gives the fix-all brief; pass agent to get your working instructions), and lockpick_get_finding for the evidence, the observed value and the expected value of each finding.
• With the CLI: lockpick brief <runId> --agent <you> and lockpick finding <runId> <findingId>. lockpick fix <runId> --agent <you> saves the brief to lockpick-fixes.md; never commit that file.
• A fix-all brief numbers the fixes. Work through them in that order, one commit per fix, report progress by number, and leave the "Steps only the owner can take" to the owner.
• Otherwise: from the pasted repair brief.

Note the severity, the affected URL or resource, what was observed, what was expected, and the repair guidance.

2. Decide whether it applies