Submission: AI-Assisted Remediation
- Name / student identifier:
- Package manager, runtime and scanner versions:
- Date and environment:
- Evidence mode: live execution / supplied-report analysis:
- Advice mode: actual approved assistant / authored sample (no account):
- If actual assistant: provider, model and date when known:
- Instruction file supplied (or not applicable for sample route):
- Report filename and scan date:
1. Critique the advice
Use at least four substantive claims or recommendations. For the sample route, quote from prompts/sample-response.md. A claim is what the advice says; evidence is the report field, source behavior, manager instruction or advisory that supports or contradicts it. Do not use the assistant's confidence as evidence.
| AI claim | Evidence (file/field, dependency path or advisory URL) | Accept / reject / needs checking | Reason and corrected action |
|---|---|---|---|
Explain which proposed command matches your manager, whether the version change is justified, and what the supplied app does with the affected package.
2. Propose and review a repair
| Package/current version | Proposed target | Advisory evidence | Compatibility risk and why this change is appropriate |
|---|---|---|---|
Exact proposed command:
Instructor approval or recorded self-study review:
3. Verify instead of trusting a claim of success
| Evidence | Before | After | Actually executed or historical artifact? |
|---|---|---|---|
| Application tests | |||
| Application output | |||
| Scan status / complete | |||
| Package / finding counts |
Attach the advice, original reports and reviewed manifest/lockfile diff. List commands actually run and their results. If using historical reports, identify their provenance and clearly mark proposed checks as unexecuted. Do not claim to have applied a repair when you only analyzed one.
4. Reflect
- Which recommendation needed correction, and what evidence changed your decision? If none needed correction, say so and explain one recommendation you independently verified.
- Does an import (or its absence) prove whether a vulnerability can be exploited here? Explain.
- If you used generated scanner instructions, what did they help with and what still required checking? For the sample route, explain why written instructions alone would not guarantee correct advice.
- What data would you refuse to send to an external assistant? What institutional permission is needed?
Do not include credentials, private source code or personal data.