/vulnerability-validation
Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable.
$ npx -y skills add codexstar69/bug-hunter --skill vulnerability-validation --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/vulnerability-validation
Context preview
The summary Claude sees to decide when to auto-load this skill.
Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable.
SKILL.md
vulnerability-validation.SKILL.mdname: vulnerability-validation
description: Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable.
Vulnerability Validation
This is a bundled local Bug Hunter companion skill. It strengthens the security-specific parts of the Skeptic/Referee process.
Purpose
Take suspected or confirmed security findings and answer:
- Is the vulnerable path reachable?
- Can an attacker control the input?
- Are there existing mitigations?
- How exploitable is it really?
- What is the CVSS / PoC / impact level?
Inputs
Prefer Bug Hunter-native artifacts:
- `.bug-hunter/hunter-findings.json`
- `.bug-hunter/threat-model.md`
- `.bug-hunter/security-config.json`
- `.bug-hunter/dep-findings.json` when dependency issues are involved
Workflow
1. Read the findings and isolate the security ones. 2. Trace reachability:
- EXTERNAL
- AUTHENTICATED
- INTERNAL
- UNREACHABLE
3. Trace exploitability:
- EASY
- MEDIUM
- HARD
- NOT_EXPLOITABLE
4. Check for mitigations already present in code, framework behavior, or deployment assumptions. 5. For confirmed HIGH/CRITICAL security bugs, generate:
- exploitation path
- benign proof of concept
- CVSS vector + score
6. Feed the result back into Bug Hunter-native verdicting.
Outputs
When used as a companion to the main pipeline, keep outputs compatible with:
- `.bug-hunter/referee.json`
- `.bug-hunter/report.md`
If a separate validation artifact is helpful for the run, place it under `.bug-hunter/validated-findings.json`.
Important constraints
- This skill validates findings; it does not replace the normal fix pipeline.
- Keep outputs portable and self-contained under `.bug-hunter/`.
- Prefer explicit reasoning for false positives so the user can trust dismissals.
Read more
name: vulnerability-validation description: Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable.
Vulnerability Validation
This is a bundled local Bug Hunter companion skill. It strengthens the security-specific parts of the Skeptic/Referee process.
Purpose
Take suspected or confirmed security findings and answer:
- Is the vulnerable path reachable?
- Can an attacker control the input?
- Are there existing mitigations?
- How exploitable is it really?
- What is the CVSS / PoC / impact level?
Inputs
Prefer Bug Hunter-native artifacts:
- `.bug-hunter/hunter-findings.json`
- `.bug-hunter/threat-model.md`
- `.bug-hunter/security-config.json`
- `.bug-hunter/dep-findings.json` when dependency issues are involved
Workflow
1. Read the findings and isolate the security ones. 2. Trace reachability:
- EXTERNAL
- AUTHENTICATED
- INTERNAL
- UNREACHABLE
3. Trace exploitability:
- EASY
- MEDIUM
- HARD
- NOT_EXPLOITABLE
4. Check for mitigations already present in code, framework behavior, or deployment assumptions. 5. For confirmed HIGH/CRITICAL security bugs, generate:
- exploitation path
- benign proof of concept
- CVSS vector + score
6. Feed the result back into Bug Hunter-native verdicting.
Outputs
When used as a companion to the main pipeline, keep outputs compatible with:
- `.bug-hunter/referee.json`
- `.bug-hunter/report.md`
If a separate validation artifact is helpful for the run, place it under `.bug-hunter/validated-findings.json`.
Important constraints
- This skill validates findings; it does not replace the normal fix pipeline.
- Keep outputs portable and self-contained under `.bug-hunter/`.
- Prefer explicit reasoning for false positives so the user can trust dismissals.
Adversarial AI bug hunter with auto-fix skill for Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI, Opencode, Pi Coding Agent, and more. Multi-agent pipeline finds security vulnerabilities, logic errors, and runtime bugs — then fixes them autonomously on a safe branch.
Repo: codexstar69/bug-hunter
Other skills on bug-hunter.
- /commit-security-scan
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of
Open skill - /doc-lookup
Unified documentation lookup for Bug Hunter agents. Uses Context Hub (chub) as primary source with Context7 API fallback. Provides verified library/framework documentation to prevent false positives and ensure correct fix patterns.
Open skill - /fixer
Surgical code fixer for Bug Hunter. Implements minimal, precise fixes for verified bugs. Uses doc-lookup (Context Hub + Context7) to verify correct API usage in patches. Respects fix strategy classifications (safe-autofix vs manual-review vs larger-refactor).
Open skill - /hunter
Deep behavioral code analysis agent for Bug Hunter. Performs multi-phase scanning to find logic errors, security vulnerabilities, race conditions, and runtime bugs. Uses doc-lookup (Context Hub + Context7) for framework verification. Reports structured JSON findings.
Open skill - /recon
Codebase reconnaissance agent for Bug Hunter. Maps architecture, identifies trust boundaries, classifies files by risk priority, and detects service boundaries. Does NOT find bugs — finds where bugs hide.
Open skill - /referee
Final arbiter for Bug Hunter. Receives Hunter findings and Skeptic challenges, independently re-reads code, and delivers authoritative verdicts with CVSS scoring and proof-of-concept generation for security findings.
Open skill