scapilix/find-bugs
skills/skills/find-bugs/SKILL.md
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
development
Updated Apr 12, 2026
$ install --global
skillsauthnpx skillsauth add scapilix/lojadiana find-bugsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
4 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
4
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 19, 2026, 7:56 PM141.8s1 file scanned
SKILL.md
- name:
- find-bugs
- description:
- Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
Find Bugs
Review changes on this branch for bugs, security vulnerabilities, and code quality issues.
Phase 1: Complete Input Gathering
- Get the FULL diff:
git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD - If output is truncated, read each changed file individually until you have seen every changed line
- List all files modified in this branch before proceeding
Phase 2: Attack Surface Mapping
For each changed file, identify and list:
- All user inputs (request params, headers, body, URL components)
- All database queries
- All authentication/authorization checks
- All session/state operations
- All external calls
- All cryptographic operations
Phase 3: Security Checklist (check EVERY item for EVERY file)
- [ ] Injection: SQL, command, template, header injection
- [ ] XSS: All outputs in templates properly escaped?
- [ ] Authentication: Auth checks on all protected operations?
- [ ] Authorization/IDOR: Access control verified, not just auth?
- [ ] CSRF: State-changing operations protected?
- [ ] Race conditions: TOCTOU in any read-then-write patterns?
- [ ] Session: Fixation, expiration, secure flags?
- [ ] Cryptography: Secure random, proper algorithms, no secrets in logs?
- [ ] Information disclosure: Error messages, logs, timing attacks?
- [ ] DoS: Unbounded operations, missing rate limits, resource exhaustion?
- [ ] Business logic: Edge cases, state machine violations, numeric overflow?
Phase 4: Verification
For each potential issue:
- Check if it's already handled elsewhere in the changed code
- Search for existing tests covering the scenario
- Read surrounding context to verify the issue is real
Phase 5: Pre-Conclusion Audit
Before finalizing, you MUST:
- List every file you reviewed and confirm you read it completely
- List every checklist item and note whether you found issues or confirmed it's clean
- List any areas you could NOT fully verify and why
- Only then provide your final findings
Output Format
Prioritize: security vulnerabilities > bugs > code quality
Skip: stylistic/formatting issues
For each issue:
- File:Line - Brief description
- Severity: Critical/High/Medium/Low
- Problem: What's wrong
- Evidence: Why this is real (not already fixed, no existing test, etc.)
- Fix: Concrete suggestion
- References: OWASP, RFCs, or other standards if applicable
If you find nothing significant, say so - don't invent issues.
Do not make changes - just report findings. I'll decide what to address.
Related Skills
scapilix/last30days
tools
VerifiedTrustedCommunity
Research a topic from the last 30 days on Reddit + X + Web, become an expert, and write copy-paste-ready prompts for the user's target tool.
SKILL.mdUpdated Apr 12, 2026
scapilix/laravel-security-audit
development
VerifiedTrustedCommunity
Security auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure practices using OWASP standards and Laravel security best practices.
SKILL.mdUpdated Apr 12, 2026
scapilix/laravel-expert
testing
VerifiedTrustedCommunity
Senior Laravel Engineer role for production-grade, maintainable, and idiomatic Laravel solutions. Focuses on clean architecture, security, performance, and modern standards (Laravel 10/11+).
SKILL.mdUpdated Apr 12, 2026
scapilix/langgraph
development
VerifiedTrustedCommunity
Expert in LangGraph - the production-grade framework for building stateful, multi-actor AI applications. Covers graph construction, state management, cycles and branches, persistence with checkpoin...
SKILL.mdUpdated Apr 12, 2026