Skip to content
cccskills
FreePublished on GitHub

security-review

Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.

The English summary is being prepared. Showing the original description.

codexstar69/bug-hunter
See how to install

Files included (1)

  • SKILL.md2.2 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Security Review

This is a bundled local Bug Hunter companion skill. It packages a security-focused review workflow without introducing any external marketplace dependency.

Purpose

Use this skill for deeper security audits than a simple bug hunt, especially when the user wants:

  • a full security review
  • PR security validation
  • weekly security scanning
  • dependency reachability + code review together
  • threat-model-driven analysis

Workflow

  1. Ensure .bug-hunter/threat-model.md exists.

    • If missing, invoke the bundled threat-model-generation skill.

  2. Determine the scan mode from the request:

    • PR → diff-scoped review via commit-security-scan
    • staged → staged-only security review
    • weekly → recent commit range on the default branch
    • full → full repository security audit

  3. If dependency scanning is relevant, run:

    • node scripts/dep-scan.cjs --target <path> --output .bug-hunter/dep-findings.json

  4. Scan code for STRIDE threats using Bug Hunter-native conventions. Reuse:

    • .bug-hunter/triage.json
    • .bug-hunter/threat-model.md
    • .bug-hunter/security-config.json
    • .bug-hunter/dep-findings.json

  5. Validate severe findings using the bundled vulnerability-validation skill.

  6. Produce structured outputs compatible with the Bug Hunter pipeline.

Outputs

Primary artifacts should stay inside .bug-hunter/:

  • .bug-hunter/hunter-findings.json
  • .bug-hunter/referee.json
  • .bug-hunter/report.md
  • .bug-hunter/dep-findings.json when dependency review is enabled
  • .bug-hunter/fix-strategy.json if the user wants remediation planning

Important constraints

  • Keep all paths Bug Hunter-native; do not emit .factory/* artifacts.
  • Prefer validated, exploitability-aware findings over raw volume.
  • For patching requests, hand findings back to the normal Bug Hunter fix pipeline rather than inventing a second patch system.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

bug-hunter

Free

Precision-first adversarial bug hunting for runtime, logic, data, concurrency, and security defects. Uses deterministic risk triage, evidence-bounded retrieval, Hunter/Skeptic/Referee review, optional hybrid verification, and explicit immutable Fixer scope. Scan-only and single-pass by default; complete-coverage loops, edits, autonomous fixes, and commits each require explicit intent. Use for code review, security audits, regression hunting, PR review, and evidence-backed remediation planning in skills-capable coding agents.

The English summary is being prepared. Showing the original description.

codexstar69/bug-hunter526Updated Aug 17, 2026

commit-security-scan

Free

Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.

The English summary is being prepared. Showing the original description.

codexstar69/bug-hunter526Updated Aug 17, 2026

doc-lookup

Free

Unified documentation lookup for Bug Hunter agents. Uses Context Hub (chub) as primary source with Context7 API fallback. Provides verified library/framework documentation to prevent false positives and ensure correct fix patterns.

The English summary is being prepared. Showing the original description.

codexstar69/bug-hunter526Updated Aug 17, 2026

fixer

Free

Surgical code fixer for Bug Hunter. Implements minimal, precise fixes for verified bugs. Uses doc-lookup (Context Hub + Context7) to verify correct API usage in patches. Respects fix strategy classifications (safe-autofix vs manual-review vs larger-refactor).

The English summary is being prepared. Showing the original description.

codexstar69/bug-hunter526Updated Aug 17, 2026

hunter

Free

Deep behavioral code analysis agent for Bug Hunter. Performs multi-phase scanning to find logic errors, security vulnerabilities, race conditions, and runtime bugs. Uses doc-lookup (Context Hub + Context7) for framework verification. Reports structured JSON findings.

The English summary is being prepared. Showing the original description.

codexstar69/bug-hunter526Updated Aug 17, 2026

recon

Free

Codebase reconnaissance agent for Bug Hunter. Maps architecture, identifies trust boundaries, classifies files by risk priority, and detects service boundaries. Does NOT find bugs — finds where bugs hide.

The English summary is being prepared. Showing the original description.

codexstar69/bug-hunter526Updated Aug 17, 2026

See all skills by codexstar69

Report a problem with this skill