Agent skill · security · aiskillstore
find-bugs
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
Why this skill is useful
Adds a detailed security audit checklist and verification process that the AI wouldn't reliably generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Find Bugs Review changes on this branch for bugs, security vulnerabilities, and code quality issues. Phase 1: Complete Input Gathering 1. Get the FULL diff: git diff master...HEAD 2. If output is truncated, read each changed file individually until you have seen every changed line 3. List all files modified in this branch before proceeding Phase 2: Attack Surface Mapping For each changed file, identify and list: All user inputs (request params, headers, body, URL components) All database queries All authentication/authorization checks All session/state operations All external calls All cryptographic operations Phase 3: Security Checklist (check EVERY item for EVERY file) [ ] Injection: SQL, command, template, header injection [ ] XSS: All outputs in templates properly escaped? [ ] Authentication: Auth checks on all protected operations? [ ] Authorization/IDOR: Access control verified, not just auth? [ ] CSRF: State-changing operations protected? [ ] Race conditions: TOCTOU in any read-then-write patterns? [ ] Session: Fixation, expiration, secure flags? [ ] Cryptography: Secure random, proper algorithms, no secrets in logs? [ ] Information disclosure: Error messages, logs, timing attacks? [ ] DoS: Unbounded operations, missing rate limits, resource exhaustion? [ ] Business logic: Edge cases, state machine violations, numeric overflow? Phase 4: Verification For each potential issue: Check if it's already handled elsewhere in the changed code Search for existing tests covering the scenario Read surrounding context to verify the issue is real Phase 5: Pre-Conclusion Audit Before finalizing, you MUST: 1. List every file you reviewed and confirm you read it completely 2. List every checklist item and note whether you found issues or confirmed it's clean 3. List any areas you could NOT fully verify and why 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/find-bugs--9d9153