Agent skill · security · sickn33
find-bugs
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
Why this skill is useful
Adds a comprehensive checklist and structured process for identifying security vulnerabilities and bugs that the AI cannot reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
Find Bugs Review changes on this branch for bugs, security vulnerabilities, and code quality issues. When to Use You need a review focused on bugs, security issues, or risky code changes. The task involves auditing the current branch diff rather than implementing new behavior. You want a structured review process with checklist-driven verification against changed files. Phase 1: Complete Input Gathering 1. Establish the requested base and head as verified commit SHAs. Check the remote/default branch if needed; do not assume a stale local branch is current. Read the full branch diff with git diff "$BASESHA...$HEADSHA" --, using validated refs in separately quoted arguments. Include staged and unstaged changes when they are in scope; preserve the checkout. 2. If output is truncated, read each changed file individually until you have seen every changed line 3. List all files modified in this branch before proceeding Phase 2: Attack Surface Mapping For each changed file, identify and list: All user inputs (request params, headers, body, URL components) All database queries All authentication/authorization checks All session/state operations All external calls All cryptographic operations Phase 3: Security Checklist (check EVERY item for EVERY file) [ ] Injection: SQL, command, template, header injection [ ] XSS: All outputs in templates properly escaped? [ ] Authentication: Auth checks on all protected operations? [ ] Authorization/IDOR: Access control verified, not just auth? [ ] CSRF: State-changing operations protected? [ ] Race conditions: TOCTOU in any read-then-write patterns? [ ] Session: Fixation, expiration, secure flags? [ ] Cryptography: Secure random, proper algorithms, no secrets in logs? [ ] Information disclosure: Error messages, logs, timing attacks? [ ] DoS: Unbounded operations, missing rate limits, resource exhaustion? [ ] Business logic: Edge cases, state machine violations, numeric overflow? Phase 4: Verification For each potential issue: Check if i …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/find-bugs--7042f6