Menu

#796 by GitHub stars

capitalone/VulnHunter

Agentic AI security tool that applies proactive, attacker-first analysis directly to source code.

Security

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

vulnhunt/SKILL.md

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

6d25b5c58b78 → 6d25b5c58b78

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6d25b5c58b78

No earlier version was observed for comparison.

Compare on GitHub

vulnhunt-fix-verify/SKILL.md

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

6d25b5c58b78 → 6d25b5c58b78

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6d25b5c58b78

No earlier version was observed for comparison.

Compare on GitHub

vulnhunter-fix/SKILL.md

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

6d25b5c58b78 → 6d25b5c58b78

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6d25b5c58b78

No earlier version was observed for comparison.

Compare on GitHub

View on GitHubAdd to my skills

Verified commit 6d25b5c58b7820809b391ecda6a102537effe3ba

1.2kGitHub stars
13stars in 7 days
3skills in this repository
2commits in 30 days

Heat

6.2
  • Star growth, last 7 daysAhead of 86% of tracked repositories
  • Star growth, last 24 hoursAhead of 92% of tracked repositories
  • Rank movement, last 7 daysAhead of 29% of tracked repositories
  • Commits, last 30 daysAhead of 60% of tracked repositories
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekAhead of 0% of tracked repositories

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Aug 2, 2026Nov 6, 20261,152

Individual skills in this repository

How it works

vulnhunt

When your agent uses it

Scan a codebase for exploitable security defects. Enumerates every user-controllable input, traces each forward to dangerous sinks, proves exploitability with executable tests, and proposes validated fixes.

What it loads into context

Frontmatter

87 tokens

Always available to the agent

SKILL.md

4,862 tokens

When the skill is activated

Reference documents

33,986 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

  1. MANDATORY FIRST ACTIONS
  2. Operating Principles
  3. Analysis Approach
  4. Workflow
  5. Phase Loading Instructions

Files

  • README.mddoc3,718 bytes
  • SKILL.mdcore20,116 bytes
  • SKILL.mdcore20,116 bytes
  • SKILL.mdcore20,116 bytes
  • SKILL.mdcore20,116 bytes
  • SKILL.mdcore20,116 bytes
  • SKILL.mdcore20,116 bytes
  • SKILL.mdcore20,116 bytes
  • SKILL.mdcore20,116 bytes
  • phases/phase1_recon.mddoc28,835 bytes
  • phases/phase2_class_inj.mddoc10,609 bytes
  • phases/phase2_class_log.mddoc8,323 bytes
  • phases/phase2_class_nav.mddoc13,664 bytes
  • phases/phase2_hunt.mddoc13,229 bytes
  • phases/phase2_shared.mddoc21,932 bytes
  • phases/phase2b_verify.mddoc16,014 bytes
  • phases/phase3_reproduce_test.mddoc12,143 bytes
  • phases/phase3c_fixes.mddoc3,602 bytes
  • phases/phase3d_sweep.mddoc7,228 bytes
  • phases/phase4_report.mddoc9,204 bytes
Read SKILL.md

# VulnHunter Security Audit Skill

## MANDATORY FIRST ACTIONS

**Step 0: Model check (interactive/direct invocation only).** When invoked
interactively — i.e. path **B** below, with no "Pre-resolved scan metadata"
block — inspect the model you are running as. If it is NOT Opus 4.7 or higher,
**STOP immediately** and tell the user (do not run any tools, resolve the target,
or offer the mode menu yet):

> ⚠<U+FE0F> VulnHunter is optimized for Claude Opus 4.7/4.8 and may be unreliable on other
> models. Please switch with the `/model opus` command, then re-run `/vulnhunt`.

Wait for the user. Only proceed past this step once they are on Opus, or if they
View the complete source on GitHub

Skills included

  • vulnhunt
  • vulnhunt-fix-verify
  • vulnhunter-fix

Repository facts

License
Apache-2.0
Created
Jul 7, 2026
Last pushed
Oct 7, 2026
Forks
166
Open issues
10
Project activity
Active

Rank over the last 12 weeks

Now #796 · best #593 · down 134 in 30 days

  1. #788 on Nov 1
  2. #791 on Nov 2
  3. #795 on Nov 3
  4. #796 on Nov 4
  5. #797 on Nov 5
  6. #796 since Nov 6
74 earlier periods
  1. #602 on Aug 2
  2. #587 on Aug 7
  3. #583 on Aug 8
  4. #586 on Aug 9
  5. #612 on Aug 10
  6. #617 on Aug 11
  7. #615 on Aug 12
  8. #617 on Aug 13
  9. #611 on Aug 14
  10. #595 on Aug 15
  11. #606 on Aug 16
  12. #610 on Aug 17
  13. #625 on Aug 18
  14. #608 from Aug 19 to Aug 20
  15. #613 on Aug 21
  16. #593 on Aug 22
  17. #622 on Aug 23
  18. #630 on Aug 24
  19. #637 on Aug 25
  20. #619 on Aug 26
  21. #646 on Aug 28
  22. #602 on Aug 29
  23. #600 on Aug 30
  24. #625 on Aug 31
  25. #641 on Sep 1
  26. #630 on Sep 2
  27. #631 on Sep 3
  28. #612 on Sep 4
  29. #619 on Sep 6
  30. #632 on Sep 7
  31. #650 on Sep 8
  32. #642 on Sep 9
  33. #644 on Sep 10
  34. #633 on Sep 11
  35. #660 on Sep 14
  36. #648 on Sep 15
  37. #656 on Sep 16
  38. #658 on Sep 17
  39. #654 on Sep 18
  40. #631 on Sep 19
  41. #642 on Sep 20
  42. #672 on Sep 22
  43. #668 on Sep 23
  44. #640 on Sep 24
  45. #629 on Sep 25
  46. #626 on Sep 26
  47. #654 on Sep 27
  48. #658 on Sep 28
  49. #699 on Sep 29
  50. #677 on Sep 30
  51. #662 on Oct 4
  52. #663 on Oct 5
  53. #659 on Oct 6
  54. #662 on Oct 7
  55. #698 on Oct 8
  56. #677 on Oct 9
  57. #660 on Oct 10
  58. #655 on Oct 11
  59. #672 on Oct 12
  60. #669 on Oct 13
  61. #683 on Oct 14
  62. #672 on Oct 15
  63. #688 on Oct 16
  64. #663 on Oct 17
  65. #692 on Oct 19
  66. #700 on Oct 20
  67. #706 on Oct 21
  68. #687 from Oct 22 to Oct 23
  69. #661 on Oct 24
  70. #767 on Oct 25
  71. #778 on Oct 28
  72. #779 on Oct 29
  73. #785 on Oct 30
  74. #789 on Oct 31

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 3, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 28 notes
  • vulnhunt/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunt/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunt/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunt/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunt/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunt/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunt/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunt-fix-verify/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunt-fix-verify/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vulnhunter-fix/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
Show all 300 signals by file

vulnhunt-fix-verify/README.md

  • Network accessline 3
    A standalone, **read-only** verification skill for [Claude Code](https://docs.claude.com/en/docs/claude-code).
  • Network accessline 12
    This skill ships as part of the [VulnHunter](https://github.com/capitalone/vulnhunter)
  • Network accessline 77
    - The [Claude Code CLI](https://docs.claude.com/en/docs/claude-code),

vulnhunt-fix-verify/comment_rules.md

  • Network accessline 81
    root's basename (e.g. `platform-validators/src/...` when neither   `REPO` nor any `ADDITIONAL_REPOS` entry has that basename). - URL: `https://github.com/...`, `git@...`, any `*.git` reference.
  • Network accessline 82
    `REPO` nor any `ADDITIONAL_REPOS` entry has that basename). - URL: `https://github.com/...`, `git@...`, any `*.git` reference. - Phrase patterns: "in our other repo", "see the upstream service",
  • Network accessline 83
    - URL: `https://github.com/...`, `git@...`, any `*.git` reference.
  • Dangerous shell operationline 110
    - Claim says "removed the eval() call", but `eval(` is still present

vulnhunt-fix-verify/phases/phase2_verify.md

  • Dangerous shell operationline 83
    (e.g. `fmt.Sprintf` building SQL, `eval(input)`, etc.).

vulnhunt/README.md

  • Network accessline 3
    The core VulnHunter scanner skill for [Claude Code](https://docs.claude.com/en/docs/claude-code).
  • Network accessline 12
    This skill ships as part of the [VulnHunter](https://github.com/capitalone/vulnhunter)
  • Network accessline 69
    - The [Claude Code CLI](https://docs.claude.com/en/docs/claude-code),

vulnhunt/SKILL.md

  • Dangerous shell operationline 213
    sink (e.g., `eval()`, raw SQL, `exec()`), you MUST read the production

vulnhunt/phases/phase1_recon.md

  • Network accessline 44
    string concatenation/interpolation into HTTP client URL arguments — patterns like `${baseUrl}${param}`, `url + param`, template literals passed to `http.get()`/`fetch()`/`request()`. These are SSRF/path-traversal sinks
  • Network accessline 45
    like `${baseUrl}${param}`, `url + param`, template literals passed to `http.get()`/`fetch()`/`request()`. These are SSRF/path-traversal sinks even when the base URL is hardcoded. Record each in the sink inventory. When
  • Network accessline 46
    `http.get()`/`fetch()`/`request()`. These are SSRF/path-traversal sinks

vulnhunt/phases/phase2_class_inj.md

  • Dangerous shell operationline 30
    - **Code evaluation**: `eval()`, `Function()`, `vm.runInNewContext()` (JS);
  • Dangerous shell operationline 31
    `exec()`, `compile()` (Python); template `.compile()`/`.render()` with
  • Network accessline 96
    `dest`, `destination`, `redir`, `url`, `target`, `forward`. Verify the redirect   target is validated against an allowlist of domains/paths — not just checked for   a prefix (attackers bypass `startsWith("https://example.com")` with
  • Network accessline 97
    target is validated against an allowlist of domains/paths — not just checked for   a prefix (attackers bypass `startsWith("https://example.com")` with   `https://example.com.evil.com`).
  • Network accessline 98
    a prefix (attackers bypass `startsWith("https://example.com")` with
  • Network accessline 99
    `https://example.com.evil.com`).

vulnhunt/phases/phase2_shared.md

  • Access to secretsline 79
    [Credential-related source omitted]

vulnhunt/phases/phase3_reproduce_test.md

  • Network accessline 57
    curl -X POST http://localhost:8080/api/endpoint \

vulnhunter-fix/README.md

  • Network accessline 3
    Automated security remediation skill for [Claude Code](https://docs.claude.com/en/docs/claude-code).
  • Network accessline 11
    This skill ships as part of the [VulnHunter](https://github.com/capitalone/vulnhunter)
  • Network accessline 30
    - The [Claude Code CLI](https://docs.claude.com/en/docs/claude-code), authenticated,
  • Network accessline 58
    claude --model opus --add-dir ~/.claude/skills/vulnhunter-fix # then in Claude Code: /vulnhunter-fix https://github.com/your-org/my-service /path/to/RepoName_VULNHUNT_RESULTS_*/
  • Network accessline 60
    /vulnhunter-fix https://github.com/your-org/my-service /path/to/RepoName_VULNHUNT_RESULTS_*/

vulnhunter-fix/SKILL.md

  • Network accessline 83
    - *"TARGET_REPO"* — full GitHub URL (e.g., `https://github.com/org/repo`)
  • Network accessline 90
    - **TARGET_REPO**: GitHub repo URL (e.g., `https://github.com/org/repo`)
  • Network accessline 91
    - **RESULTS_PATH**: Path to VulnHunter results — either:   - Local directory: `/path/to/RepoName_VULNHUNT_RESULTS_*/`   - GitHub repo URL: `https://github.com/org/vuln-findings` (will be cloned)
  • Network accessline 93
    - GitHub repo URL: `https://github.com/org/vuln-findings` (will be cloned)
  • Network accessline 117
    The skill itself is versioned in `https://github.com/capitalone/vulnhunter` on `main`. Stale installs miss bug fixes (today the failure list includes: TLS-quirk handoffs, sandbox-friendly clone flags, the cluster-as-PR semantic, the `--repo
  • Access to secretsline 164
    [Credential-related source omitted]
  • Network accessline 166
    - TLS errors: `tls: failed to verify certificate`, `x509: OSStatus -…`, `SSL certificate problem: unable to get local issuer certificate`, `Could not resolve host: api.github.com`. - Sandbox / filesystem denials during `git clone`: `Operati
  • Network accessline 167
    - Sandbox / filesystem denials during `git clone`: `Operation not permitted` when copying hook templates into `.git/hooks/`, `fatal: cannot copy '…/commit-msg.sample' to '…/.git/hooks/…'`. - Transient transport errors: `Post "https://api.gi
  • Network accessline 168
    - Transient transport errors: `Post "https://api.github.com/graphql": …`, `dial tcp …: i/o timeout`.
  • Network accessline 173
    1. **STOP.** Do not retry the same command. Do not retry with different flags. Do not invoke a different but equivalent tool — that is the worst trap. Examples of forbidden "fixes":    - `git clone` fails → trying `gh repo clone` instead.
  • Network accessline 174
    - `git clone` fails → trying `gh repo clone` instead.    - `gh issue list` fails → trying `git ls-remote` or `curl https://api.github.com/...`.    - `git clone <url> <repo-relative-path>` fails on sandbox → trying `git clone <url> $TMPDIR/.
  • Network accessline 175
    - `gh issue list` fails → trying `git ls-remote` or `curl https://api.github.com/...`.
  • Access to secretsline 179
    [Credential-related source omitted]

vulnhunter-fix/evals/evals.json

  • Network accessline 4
    {       "id": 1,       "prompt": "/vulnfix https://github.com/example/app ./results/app_VULNHUNT_RESULTS_sonnet46_2026-05-01/",
  • Network accessline 5
    "id": 1,       "prompt": "/vulnfix https://github.com/example/app ./results/app_VULNHUNT_RESULTS_sonnet46_2026-05-01/",       "expected_output": "Parses findings, presents a remediation plan with priorities, asks for confirmation",
  • Network accessline 6
    "prompt": "/vulnfix https://github.com/example/app ./results/app_VULNHUNT_RESULTS_sonnet46_2026-05-01/",
  • Network accessline 65
    {       "id": 3,       "prompt": "/vulnfix https://github.com/org/private-repo ./results/",
  • Network accessline 66
    "id": 3,       "prompt": "/vulnfix https://github.com/org/private-repo ./results/",       "expected_output": "Detects no write access and falls back to creating a GitHub issue",
  • Network accessline 67
    "prompt": "/vulnfix https://github.com/org/private-repo ./results/",

vulnhunter-fix/prompts/deliver.md

  • Network accessline 257
    | VULN ID | Severity | Issue | Delivery | URL | |---------|----------|-------|----------|-----| | VULN-001 | Critical | #1 | PR (ready) ✓ | https://github.com/fork-org/fork-repo/pull/2 |
  • Network accessline 258
    |---------|----------|-------|----------|-----| | VULN-001 | Critical | #1 | PR (ready) ✓ | https://github.com/fork-org/fork-repo/pull/2 | | VULN-002 | High | #3 | PR (draft — setup required) ⚠<U+FE0F> needs-human-review | https://github.com/fork-
  • Network accessline 259
    | VULN-001 | Critical | #1 | PR (ready) ✓ | https://github.com/fork-org/fork-repo/pull/2 |
  • Network accessline 260
    | VULN-002 | High | #3 | PR (draft — setup required) ⚠<U+FE0F> needs-human-review | https://github.com/fork-org/fork-repo/pull/4 |
  • Network accessline 261
    | VULN-003 | Medium | #5 | Issue only (design unresolved) | https://github.com/fork-org/fork-repo/issues/5 |
  • Dangerous shell operationline 300
    rm -rf ./work
  • Access to secretsline 347
    [Credential-related source omitted]
  • Access to secretsline 373
    [Credential-related source omitted]
  • Access to secretsline 374
    [Credential-related source omitted]
  • Access to secretsline 377
    [Credential-related source omitted]
  • Access to secretsline 382
    [Credential-related source omitted]
  • Dangerous shell operationline 460
    `.vulnhunter-fix/` stays in place after delivery — the user owns it under their repo root and `.git/info/exclude` keeps it out of commits. They can `rm -rf .vulnhunter-fix/` manually when satisfied. The skill does NOT delete it automaticall

vulnhunter-fix/prompts/implement.md

  • Access to secretsline 30
    [Credential-related source omitted]
  • Access to secretsline 33
    [Credential-related source omitted]
  • Dangerous shell operationline 77
    rm "$TMPDIR/vulnfix-exploits/exploit_VULN_NNN."*
  • Dangerous shell operationline 421
    rm "$TMPDIR/vulnfix-exploits/exploit_VULN_NNN."*

vulnhunter-fix/prompts/parse.md

  • Network accessline 5
    - `RESULTS_PATH`: Path to VulnHunter results (local directory or GHE repo URL) - `TARGET_REPO`: GitHub repo URL to fix (e.g., `https://github.com/org/repo`)
  • Network accessline 6
    - `TARGET_REPO`: GitHub repo URL to fix (e.g., `https://github.com/org/repo`)
  • Network accessline 14
    If `RESULTS_PATH` is a URL (starts with `https://`), clone it first:

vulnhunter-fix/prompts/parse_issues.md

  • Network accessline 87
    # echo "[" > .vulnhunter-fix/raw_issues.json # first=1 # for url in https://github.com/org/repo/issues/42 https://github.com/org/repo/issues/43; do
  • Network accessline 88
    # first=1 # for url in https://github.com/org/repo/issues/42 https://github.com/org/repo/issues/43; do #     number="${url##*/}"
  • Network accessline 89
    # for url in https://github.com/org/repo/issues/42 https://github.com/org/repo/issues/43; do
  • Access to secretsline 115
    [Credential-related source omitted]
  • Network accessline 368
    # Security: REPORT_URL was extracted from an issue body. An attacker # who can apply the `vulnhunter` label to a crafted issue could # otherwise inject `Full report: https://attacker.example/...` and
  • Network accessline 369
    # who can apply the `vulnhunter` label to a crafted issue could # otherwise inject `Full report: https://attacker.example/...` and # we'd clone+trust their repo as the report source. Allowlist the
  • Network accessline 370
    # otherwise inject `Full report: https://attacker.example/...` and
  • Network accessline 374
    PUBLISH_HOST="" case "$PUBLISH_REPO" in     http://*|https://*|ssh://*)
  • Network accessline 375
    case "$PUBLISH_REPO" in     http://*|https://*|ssh://*)         PUBLISH_HOST="${PUBLISH_REPO#*://}"
  • Network accessline 376
    http://*|https://*|ssh://*)
  • Dangerous shell operationline 406
    rm -rf "$PUBLISH_CLONE" 2>/dev/null
  • Dangerous shell operationline 450
    rm -rf <project_root>/.vulnhunter-fix/publish/repo
  • Access to secretsline 546
    [Credential-related source omitted]
  • Dangerous shell operationline 646
    rm -rf "$SCRATCH"

vulnhunter-fix/prompts/worker_agent_common.md

  • Dangerous shell operationline 212
    rm "$TMPDIR/vulnfix-exploits/exploit_${VULN_ID}."*
  • Dangerous shell operationline 304
    rm {resolved_test_dir}/verify_{VULN_ID}_*

vulnhunter-fix/pyproject.toml

  • Network accessline 24
    [project.urls] github = "https://github.com/capitalone/vulnhunter"
  • Network accessline 25
    github = "https://github.com/capitalone/vulnhunter"

vulnhunter-fix/references/approved-key-sources.yaml

  • Access to secretsline 45
    [Credential-related source omitted]
  • Access to secretsline 46
    [Credential-related source omitted]
  • Access to secretsline 64
    [Credential-related source omitted]

vulnhunter-fix/references/finding-schema.json

  • Network accessline 1
    {   "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 2
    "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 3
    "$id": "https://vulnhunter-fix/references/finding-schema.json",

vulnhunter-fix/references/fix_plan-schema.json

  • Network accessline 1
    {   "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 2
    "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 3
    "$id": "https://vulnhunter-fix/references/fix_plan-schema.json",

vulnhunter-fix/references/result-schema.json

  • Network accessline 1
    {   "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 2
    "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 3
    "$id": "https://vulnhunter-fix/references/result-schema.json",

vulnhunter-fix/references/sweep-patterns.md

  • Access to secretsline 74
    [Credential-related source omitted]

vulnhunter-fix/references/test-quality-rubric.md

  • Network accessline 56
    Detection: - Scan reports SSRF via `http://internal/`: test payload uses `http://internal/`-shaped URL, not `file:///etc/passwd`.
  • Network accessline 57
    - Scan reports SSRF via `http://internal/`: test payload uses `http://internal/`-shaped URL, not `file:///etc/passwd`.

vulnhunter-fix/references/triage-schema.json

  • Network accessline 1
    {   "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 2
    "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 3
    "$id": "https://vulnhunter-fix/references/triage-schema.json",

vulnhunter-fix/scripts/_skill_bootstrap.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 61
    [Credential-related source omitted]
  • Access to secretsline 66
    [Credential-related source omitted]

vulnhunter-fix/scripts/anti-merge-check.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/build_graph.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/check-body-completeness.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/check-committed-test-naming.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/check-idempotency.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/check-scope.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/check-severity-mask.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/check_repo_access.sh

  • Executable scriptline 1
    #!/usr/bin/env bash
  • Network accessline 10
    # Extract owner/repo from URL (handles https://github.com/org/repo and github.com/org/repo)

vulnhunter-fix/scripts/clone_repo.sh

  • Executable scriptline 1
    #!/usr/bin/env bash
  • Network accessline 95
    echo "Cloning fork ${FORK_FULL}..."   git -c init.templateDir= clone --template= --depth 1 "https://github.com/${FORK_FULL}.git" "${TARGET_DIR}/${FORK_REPO_NAME}" 2>&1
  • Network accessline 96
    git -c init.templateDir= clone --template= --depth 1 "https://github.com/${FORK_FULL}.git" "${TARGET_DIR}/${FORK_REPO_NAME}" 2>&1
  • Network accessline 106
    else   echo "Cloning ${OWNER_REPO}..."   git -c init.templateDir= clone --template= --depth 1 "https://github.com/${OWNER_REPO}.git" "${TARGET_DIR}/${REPO_NAME}" 2>&1
  • Network accessline 108
    git -c init.templateDir= clone --template= --depth 1 "https://github.com/${OWNER_REPO}.git" "${TARGET_DIR}/${REPO_NAME}" 2>&1

vulnhunter-fix/scripts/cluster_score.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/scripts/compute-completeness-tier.py

  • Executable scriptline 1
    #!/usr/bin/env python3
  • Access to secretsline 108
    [Credential-related source omitted]

vulnhunter-fix/scripts/crypto-trust-chain-checkers.py

  • Executable scriptline 1
    #!/usr/bin/env python3
  • Network accessline 159
    """Drop a trailing line comment so an approved identifier sitting in a     comment can't green-light weak code (12-seg review S7a). Matches a `#` or     `//` preceded by start-of-line or whitespace — so `https://` inside a
  • Network accessline 160
    comment can't green-light weak code (12-seg review S7a). Matches a `#` or     `//` preceded by start-of-line or whitespace — so `https://` inside a     string is left intact. String-literal contents are deliberately kept: a
  • Network accessline 161
    `//` preceded by start-of-line or whitespace — so `https://` inside a
  • Network accessline 315
    TRANSPORT_DENIED = [     r"\bhttp://(?!localhost|127\.0\.0\.1)",
  • Network accessline 316
    r"\bhttp://(?!localhost|127\.0\.0\.1)",

vulnhunter-fix/scripts/detect_mode.sh

  • Executable scriptline 1
    #!/usr/bin/env bash
  • Network accessline 60
    host="${host%%:*}"             ;;         http://*|https://*|ssh://*)
  • Network accessline 61
    ;;         http://*|https://*|ssh://*)             host="${ORIGIN#*://}"
  • Network accessline 62
    http://*|https://*|ssh://*)
  • Network accessline 81
    stripped="${stripped#*:}"                 ;;             http://*|https://*|ssh://*)
  • Network accessline 82
    ;;             http://*|https://*|ssh://*)                 stripped="${stripped#*://}"
  • Network accessline 83
    http://*|https://*|ssh://*)

vulnhunter-fix/scripts/heading-sync-lint.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/issue_intake.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/scripts/language-detect.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/parse-tier-judgment.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/parse_results.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/pr-body-check.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/preflight.py

  • Executable scriptline 1
    #!/usr/bin/env python3
  • Network accessline 85
    gh = shutil.which("gh")     if not gh:         check("gh CLI", False, "not found in PATH — install from https://cli.github.com")
  • Network accessline 86
    if not gh:         check("gh CLI", False, "not found in PATH — install from https://cli.github.com")         return
  • Network accessline 87
    check("gh CLI", False, "not found in PATH — install from https://cli.github.com")
  • Access to secretsline 209
    [Credential-related source omitted]
  • Access to secretsline 312
    [Credential-related source omitted]
  • Access to secretsline 313
    [Credential-related source omitted]
  • Access to secretsline 314
    [Credential-related source omitted]
  • Access to secretsline 315
    [Credential-related source omitted]
  • Access to secretsline 316
    [Credential-related source omitted]
  • Access to secretsline 344
    [Credential-related source omitted]

vulnhunter-fix/scripts/prompt-lint.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/run-gates.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/safe-phrase-sync-lint.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/setup_worktree.sh

  • Executable scriptline 1
    #!/usr/bin/env bash

vulnhunter-fix/scripts/sweep-root-causes.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/validate-finding.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/validate-fix-plan.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/validate-result.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/validate-triage.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/validate-verification.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/validate_findings_draft.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/scripts/validate_pr_body.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/scripts/worker-preamble-sync-lint.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/scripts/worktree-reset.py

  • Executable scriptline 1
    #!/usr/bin/env python3

vulnhunter-fix/tests/__init__.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/conftest.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 26
    [Credential-related source omitted]

vulnhunter-fix/tests/graph_fixtures/go/sample_auth.go

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/graph_fixtures/python/sample_auth.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_branch_naming_helpers.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_build_graph.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_check_committed_test_naming.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_cluster_score.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_contract_end_to_end.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_crypto_checkers.py

  • Executable scriptline 1
    Executable file
  • Network accessline 146
    [Credential-related source omitted]
  • Network accessline 147
    [Credential-related source omitted]
  • Network accessline 148
    [Credential-related source omitted]
  • Network accessline 267
    def test_transport_https_approved(crypto):     ok, ev = crypto.check_transport_encrypted("+url = 'https://example.com'\n")
  • Network accessline 268
    ok, ev = crypto.check_transport_encrypted("+url = 'https://example.com'\n")
  • Network accessline 277
    def test_transport_denied_http(crypto):     ok, ev = crypto.check_transport_encrypted("+url = 'http://example.com'\n")
  • Network accessline 278
    ok, ev = crypto.check_transport_encrypted("+url = 'http://example.com'\n")
  • Network accessline 284
    """http://localhost should NOT trigger denied pattern (dev-only)."""
  • Network accessline 285
    ok, ev = crypto.check_transport_encrypted("+url = 'http://localhost:8080'\n")
  • Network accessline 291
    def test_transport_verify_false_denied(crypto):     ok, ev = crypto.check_transport_encrypted("+requests.get(url, verify=False)\n")
  • Network accessline 292
    ok, ev = crypto.check_transport_encrypted("+requests.get(url, verify=False)\n")
  • Network accessline 308
    "+++ b/foo.py\n"         "+from cryptography.hazmat.primitives.ciphers.aead import AESGCM\n"         "+key = ChamberClient().fetch('key')\n"
  • Network accessline 309
    "+from cryptography.hazmat.primitives.ciphers.aead import AESGCM\n"         "+key = ChamberClient().fetch('key')\n"         "+rotate_key(key_id)\n"
  • Network accessline 310
    "+key = ChamberClient().fetch('key')\n"
  • Network accessline 311
    "+rotate_key(key_id)\n"         "+url = 'https://api.example.com'\n"     )
  • Network accessline 312
    "+url = 'https://api.example.com'\n"

vulnhunter-fix/tests/test_detect_mode_sh.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 20
    [Credential-related source omitted]
  • Network accessline 47
    class TestInPlace:     def test_https_github_origin(self, tmp_path):         repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 48
    def test_https_github_origin(self, tmp_path):         repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")         result = _run(repo)
  • Network accessline 49
    repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 62
    def test_github_enterprise_origin(self, tmp_path):         repo = _init_repo(             tmp_path, origin="https://github.example.com/team/repo.git"
  • Network accessline 63
    repo = _init_repo(             tmp_path, origin="https://github.example.com/team/repo.git"         )
  • Network accessline 64
    tmp_path, origin="https://github.example.com/team/repo.git"
  • Network accessline 75
    result = _run(             tmp_path,             "https://github.com/acme/widgets", "/tmp/results",
  • Network accessline 76
    tmp_path,             "https://github.com/acme/widgets", "/tmp/results",         )
  • Network accessline 77
    "https://github.com/acme/widgets", "/tmp/results",
  • Network accessline 79
    assert result.returncode == 0         assert "mode=fork" in result.stdout         assert "target=https://github.com/acme/widgets" in result.stdout
  • Network accessline 80
    assert "mode=fork" in result.stdout         assert "target=https://github.com/acme/widgets" in result.stdout         assert "results=/tmp/results" in result.stdout
  • Network accessline 81
    assert "target=https://github.com/acme/widgets" in result.stdout
  • Network accessline 85
    result = _run(             tmp_path,             TARGET_REPO="https://github.com/x/y",
  • Network accessline 86
    tmp_path,             TARGET_REPO="https://github.com/x/y",             RESULTS_PATH="/tmp/r",
  • Network accessline 87
    TARGET_REPO="https://github.com/x/y",
  • Network accessline 94
    class TestAmbiguous:     def test_args_supplied_while_in_github_repo(self, tmp_path):         repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 95
    def test_args_supplied_while_in_github_repo(self, tmp_path):         repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")         result = _run(
  • Network accessline 96
    repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 97
    result = _run(             repo,             "https://github.com/other/repo", "/tmp/r",
  • Network accessline 98
    repo,             "https://github.com/other/repo", "/tmp/r",         )
  • Network accessline 99
    "https://github.com/other/repo", "/tmp/r",
  • Network accessline 103
    assert "mode=ambiguous" in result.stdout         assert "owner_repo=acme/widgets" in result.stdout         assert "target=https://github.com/other/repo" in result.stdout
  • Network accessline 105
    assert "target=https://github.com/other/repo" in result.stdout
  • Network accessline 113
    def test_positional_results_path_only(self, tmp_path):         repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 114
    repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 123
    def test_env_results_path_only(self, tmp_path):         repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 124
    repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 134
    repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 135
    result = _run(repo, TARGET_REPO="https://github.com/other/repo")
  • Network accessline 141
    repo = _init_repo(tmp_path, origin="https://github.com/acme/widgets.git")
  • Network accessline 142
    result = _run(repo, "https://github.com/other/repo", "/tmp/r")
  • Network accessline 160
    def test_git_but_non_github_origin(self, tmp_path):         repo = _init_repo(tmp_path, origin="https://gitlab.com/a/b.git")
  • Network accessline 161
    repo = _init_repo(tmp_path, origin="https://gitlab.com/a/b.git")
  • Network accessline 172
    repo = _init_repo(             tmp_path, origin="https://gitlab.com/myorg/github-mirror.git"
  • Network accessline 173
    tmp_path, origin="https://gitlab.com/myorg/github-mirror.git"

vulnhunter-fix/tests/test_gate2_cli_contract.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_gate_scripts.py

  • Executable scriptline 1
    Executable file
  • Possible obfuscationline 106
    body.write_text("This is a cri<U+200B>tical vulnerability.\n", encoding="utf-8")

vulnhunter-fix/tests/test_graph_build_bugs.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_graph_fixture_regression.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_graph_query.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 67
    [Credential-related source omitted]
  • Access to secretsline 69
    [Credential-related source omitted]

vulnhunter-fix/tests/test_hand_wave_guard.py

  • Executable scriptline 1
    Executable file
  • Network accessline 30
    "Auth bypass on /admin — the framework adequately handles this",     "XSS via /search — input is properly validated upstream",     "SSRF in fetch() — properly handled by the gateway",
  • Network accessline 31
    "XSS via /search — input is properly validated upstream",     "SSRF in fetch() — properly handled by the gateway", ]
  • Network accessline 32
    "SSRF in fetch() — properly handled by the gateway",

vulnhunter-fix/tests/test_issue_intake.py

  • Executable scriptline 1
    Executable file
  • Network accessline 61
    repo=repo,         number=number,         url=f"https://github.com/{owner}/{repo}/issues/{number}",
  • Network accessline 62
    number=number,         url=f"https://github.com/{owner}/{repo}/issues/{number}",         title="",
  • Network accessline 63
    url=f"https://github.com/{owner}/{repo}/issues/{number}",

vulnhunter-fix/tests/test_json_schema_validators.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_lint_and_language.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_llm_review_resolution.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_parse_results.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_pr_body_check.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_preflight_in_place.py

  • Executable scriptline 1
    Executable file
  • Network accessline 53
    def test_no_op_when_origin_is_non_github(self, tmp_path, monkeypatch, capsys):         repo = _init_repo(tmp_path, origin="https://gitlab.com/a/b.git")
  • Network accessline 54
    repo = _init_repo(tmp_path, origin="https://gitlab.com/a/b.git")
  • Network accessline 60
    def test_clean_tree_passes(self, tmp_path, monkeypatch, capsys):         repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 61
    repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 67
    def test_dirty_tree_fails(self, tmp_path, monkeypatch, capsys):         repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 68
    repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 76
    def test_staged_changes_fail(self, tmp_path, monkeypatch, capsys):         repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 77
    repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 86
    self, tmp_path, monkeypatch, capsys     ):         repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 87
    ):         repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")         monkeypatch.chdir(repo)
  • Network accessline 88
    repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 99
    repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 104
    import urllib.request             called = {"urlopen": False}             orig = urllib.request.urlopen
  • Network accessline 105
    called = {"urlopen": False}             orig = urllib.request.urlopen             def spy(*a, **kw):
  • Network accessline 106
    orig = urllib.request.urlopen
  • Network accessline 117
    class TestDetectInPlaceRoot:     def test_returns_repo_root_inside_github_repo(self, tmp_path, monkeypatch):         repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 118
    def test_returns_repo_root_inside_github_repo(self, tmp_path, monkeypatch):         repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")         monkeypatch.chdir(repo)
  • Network accessline 119
    repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 129
    def test_returns_none_for_non_github_origin(self, tmp_path, monkeypatch):         repo = _init_repo(tmp_path, origin="https://gitlab.com/a/b.git")
  • Network accessline 130
    repo = _init_repo(tmp_path, origin="https://gitlab.com/a/b.git")
  • Network accessline 144
    def test_probe_skipped_when_in_place(self, tmp_path, monkeypatch, capsys):         repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")
  • Network accessline 145
    repo = _init_repo(tmp_path, origin="https://github.com/a/b.git")

vulnhunter-fix/tests/test_run_gates.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_schema_repair_loop.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_setup_worktree.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 122
    [Credential-related source omitted]

vulnhunter-fix/tests/test_sweep_and_verification.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_validate_findings_draft.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_validate_pr_body.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_worker_preamble_sync.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/tests/test_worktree_reset.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 33
    [Credential-related source omitted]
  • Access to secretsline 52
    [Credential-related source omitted]

vulnhunter-fix/vulnhunter_fix/__init__.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/vulnhunter_fix/delivery.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/vulnhunter_fix/graph/__init__.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/vulnhunter_fix/graph/build.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 51
    [Credential-related source omitted]

vulnhunter-fix/vulnhunter_fix/graph/config.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 25
    [Credential-related source omitted]
  • Access to secretsline 26
    [Credential-related source omitted]
  • Access to secretsline 27
    [Credential-related source omitted]
  • Access to secretsline 28
    [Credential-related source omitted]
  • Access to secretsline 29
    [Credential-related source omitted]
  • Access to secretsline 69
    [Credential-related source omitted]

vulnhunter-fix/vulnhunter_fix/graph/fallback.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/vulnhunter_fix/graph/query.py

  • Executable scriptline 1
    Executable file

vulnhunter-fix/vulnhunter_fix/graph/schema.py

  • Executable scriptline 1
    Executable file

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

No combined signals at this commit.

Works with

Agent compatibility, from the files in this repository
AgentStatusEvidenceInstall to
Claude CodeCompatibleStandard SKILL.md vulnhunt/SKILL.md.claude/skills/<skill-name>/
CodexCompatibleStandard SKILL.md vulnhunt/SKILL.md.agents/skills/<skill-name>/
CursorCompatibleStandard SKILL.md vulnhunt/SKILL.md.cursor/skills/<skill-name>/
Gemini CLICompatibleStandard SKILL.md vulnhunt/SKILL.md.gemini/skills/<skill-name>/
GitHub CopilotCompatibleStandard SKILL.md vulnhunt/SKILL.md.github/skills/<skill-name>/
OpenCodeCompatibleStandard SKILL.md vulnhunt/SKILL.md.opencode/skills/<skill-name>/
  • Native The repository ships a manifest, folder or frontmatter field for this agent.
  • Compatible A standard SKILL.md that this agent can read.
  • Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

You might also use

cloudflare/security-audit-skill

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, s…

62.5kGitHub stars

mukul975/Anthropic-Cybersecurity-Skills

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io …

35.7kGitHub stars

shadow1ng/fscan

使用 fscan 进行网络扫描和安全评估。当用户要求扫描网段、探测主机存活、发现开放端口、识别服务、检测漏洞或弱口令时使用。支持 NDJSON 结构化输出，适合 AI agent 管道消费。

14.7kGitHub stars

SnailSploit/Claude-Red

claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level m…

10.4kGitHub stars

shadcn/improve

Survey any codebase as a senior advisor and produce prioritized, self-contained implementation plans for OTHER models/agents to execute. Strictly read-only on source code — never …

9.3kGitHub stars

trailofbits/skills

Trail of Bits skills for security research, vulnerability detection, and audit workflows

8kGitHub stars

Explore alternatives and comparisons

Add this badge to your README

It updates every night and links to this page.

capitalone/VulnHunter: #796 on hotskills, 1.2k stars

[![capitalone/VulnHunter on hotskills](https://hotskills.dev/badge/capitalone-vulnhunter.svg)](https://hotskills.dev/skill/capitalone-vulnhunter/)