What’s inside

One SKILL.md (the playbook) + one starter template. A preview:

Vulnerability Hunter

When to use

• You want a second pair of eyes on your own codebase for business-logic flaws (broken access control, auth bypasses, bad state transitions) that scanners miss
• A vendor released a security patch and you want to understand what it actually fixed before applying it
• You want to check whether a known fixed bug has unpatched variants hiding elsewhere in the code
• Recent commits need review for vulnerability patterns before release
• You need a root-cause report on a suspected flaw, with reproduction steps — while you keep the fix and disclosure decisions

Workflow

1. Scope the review (input: your codebase or commit range → output: review scope)
   You define exactly what gets reviewed: your repo, a module, a commit range. The skill only ever touches code you own or are authorized to test. Scope is human-set, always — this is a defensive skill, not a reconnaissance tool.
2. Hunt for logic flaws (input: scoped code → output: candidate findings)
   AI reviewers read the code — in parallel across modules when the codebase is large — focusing on business logic: authorization checks, state transitions, trust boundaries. Not just known CVE patterns, but the "the code works as written, and that's the problem" class. Every finding at this stage is a candidate, not a verdict.
3. Reproduce in a sandbox (input: candidate finding → output: reproduction result)
   Every finding must be reproduced in an isolated sandbox before it's reported as real. Unreproduced findings are labeled unconfirmed, not dropped silently. This step is mandatory because AI security review has a high false-positive rate — reproduction is how the skill stays honest.
4. Report the root cause (input: confirmed finding → output: root-cause report)
   Write up what the flaw is, why it exists, the full attack path, and the reproduction steps. For patch-diff work: diff the patch to locate what was fixed, classify the bug, then search the codebase for the same pattern that the patch missed.
5. Propose and verify the fix (input: report → output: fix PR + verification)
   The AI drafts the patch and opens a pull request — you review and merge. After merging, the reproduction case is re-run to confirm the hole is actually closed, not just covered.
6. Control disclosure (input: confirmed vulnerability → output: disclosure plan)
   You decide the patching timeline, who gets told what, and when. The skill never publishes vulnerability details, never contacts third parties, and never tests anything outside your own isolated environment.

Output spec

Template preview

Vulnerability Hunter — Finding Report Template

One report per review run. A finding without sandbox reproduction is a hypothesis — label it as one.

Review run — {date}

Scope: {your repo / module / commit range — you own or are authorized to test this} Authorization confirmed: [ ] yes — this is my code / I have written permission to test it Sandbox: {isolated environment used for reproduction}

Finding 1 — {short title}

Severity: {critical / high / medium / low} — {one-line justification} Status: [ ] confirmed in sandbox [ ] unconfirmed hypothesis

Root cause: {why the flaw exists — the logic error, not just the symptom}

Buy the full skill pack — $4.99 Pro — all 471 skills