commit-security-scan
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks…
@codexstar69Install SkillSecurity
Skill
/security-review
Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context
Claude Code
$ npx -y skills add codexstar69/bug-hunter --skill security-review --agent claude-code
Codex
$ npx skills add codexstar69/bug-hunter --skill security-review -a codex -y
Cursor
$ npx skills add codexstar69/bug-hunter --skill security-review -a cursor -y
Gemini CLI
$ npx skills add codexstar69/bug-hunter --skill security-review -a gemini-cli -y
GitHub Copilot
$ npx skills add codexstar69/bug-hunter --skill security-review -a github-copilot -y
OpenCode
$ npx skills add codexstar69/bug-hunter --skill security-review -a opencode -y
Windsurf
$ npx skills add codexstar69/bug-hunter --skill security-review -a windsurf -y
SKILL.md
security-review.SKILL.mdname: security-review
description: Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.
Security Review
This is a bundled local Bug Hunter companion skill. It packages a security-focused review workflow without introducing any external marketplace dependency.
Purpose
Use this skill for deeper security audits than a simple bug hunt, especially when the user wants:
- a full security review
- PR security validation
- weekly security scanning
- dependency reachability + code review together
- threat-model-driven analysis
Workflow
1. Ensure `.bug-hunter/threat-model.md` exists.
- If missing, invoke the bundled `threat-model-generation` skill.
2. Determine the scan mode from the request:
- PR → diff-scoped review via `commit-security-scan`
- staged → staged-only security review
- weekly → recent commit range on the default branch
- full → full repository security audit
3. If dependency scanning is relevant, run:
- `node scripts/dep-scan.cjs --target <path> --output .bug-hunter/dep-findings.json`
4. Scan code for STRIDE threats using Bug Hunter-native conventions. Reuse:
- `.bug-hunter/triage.json`
- `.bug-hunter/threat-model.md`
- `.bug-hunter/security-config.json`
- `.bug-hunter/dep-findings.json`
5. Validate severe findings using the bundled `vulnerability-validation` skill.
6. Produce structured outputs compatible with the Bug Hunter pipeline.
Outputs
Primary artifacts should stay inside `.bug-hunter/`:
- `.bug-hunter/hunter-findings.json`
- `.bug-hunter/referee.json`
- `.bug-hunter/report.md`
- `.bug-hunter/dep-findings.json` when dependency review is enabled
- `.bug-hunter/fix-strategy.json` if the user wants remediation planning
Important constraints
- Keep all paths Bug Hunter-native; do not emit `.factory/*` artifacts.
- Prefer validated, exploitability-aware findings over raw volume.
- For patching requests, hand findings back to the normal Bug Hunter fix pipeline rather than inventing a second patch system.
Read more
name: security-review description: Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.
Security Review
This is a bundled local Bug Hunter companion skill. It packages a security-focused review workflow without introducing any external marketplace dependency.
Purpose
Use this skill for deeper security audits than a simple bug hunt, especially when the user wants:
- a full security review
- PR security validation
- weekly security scanning
- dependency reachability + code review together
- threat-model-driven analysis
Workflow
1. Ensure `.bug-hunter/threat-model.md` exists.
- If missing, invoke the bundled `threat-model-generation` skill.
2. Determine the scan mode from the request:
- PR → diff-scoped review via `commit-security-scan`
- staged → staged-only security review
- weekly → recent commit range on the default branch
- full → full repository security audit
3. If dependency scanning is relevant, run:
- `node scripts/dep-scan.cjs --target <path> --output .bug-hunter/dep-findings.json`
4. Scan code for STRIDE threats using Bug Hunter-native conventions. Reuse:
- `.bug-hunter/triage.json`
- `.bug-hunter/threat-model.md`
- `.bug-hunter/security-config.json`
- `.bug-hunter/dep-findings.json`
5. Validate severe findings using the bundled `vulnerability-validation` skill.
6. Produce structured outputs compatible with the Bug Hunter pipeline.
Outputs
Primary artifacts should stay inside `.bug-hunter/`:
- `.bug-hunter/hunter-findings.json`
- `.bug-hunter/referee.json`
- `.bug-hunter/report.md`
- `.bug-hunter/dep-findings.json` when dependency review is enabled
- `.bug-hunter/fix-strategy.json` if the user wants remediation planning
Important constraints
- Keep all paths Bug Hunter-native; do not emit `.factory/*` artifacts.
- Prefer validated, exploitability-aware findings over raw volume.
- For patching requests, hand findings back to the normal Bug Hunter fix pipeline rather than inventing a second patch system.
Stats
558
Stars
66
Forks
Active
Maintenance
JavaScript
Language
MIT
License
Last commit
Created
Ships withbug-hunter
Adversarial AI bug hunter with auto-fix skill for Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI, Opencode, Pi Coding Agent, and more. Multi-agent pipeline finds security vulnerabilities, logic errors, and runtime bugs — then fixes them autonomously on a safe branch.
54610 skills
Stars on GitHub
Momentum
- stars in total
- 546
Other skills on bug-hunter.
@codexstar69Install Skilldoc-lookup
Unified documentation lookup for Bug Hunter agents. Uses Context Hub (chub) as primary source with Context7 API fallback.…
@codexstar69Install Skillfixer
Surgical code fixer for Bug Hunter. Implements minimal, precise fixes for verified bugs. Uses doc-lookup (Context Hub + Context7)…
@codexstar69Install Skillhunter
Behavioral code analysis for Bug Hunter. Finds logic, security, concurrency, and contract defects with traced runtime triggers…
@codexstar69Install Skillrecon
Triage enrichment for Bug Hunter. Maps tech stack, trust, state, error, concurrency, and service boundaries without reclassifying…
@codexstar69Install Skillreferee
Final arbiter for Bug Hunter. Independently verifies behavioral findings, resolves Skeptic challenges, and calibrates severity…
@codexstar69Install SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about security-review.
- Which coding agents can use security-review?
- security-review installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.