Skip to content

Search skills.../

Agent Skill Search Engine

Search

Search
Categories
Occupations

About

About
Privacy
Terms

© 2026 Skills Pool. All rights reserved.

Find Bugs | Skills Pool

Skill File

Find Bugs

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

davila724,709 starsJan 6, 2026

Occupation
Categories: Automation Tools

Skill Content

Review changes on this branch for bugs, security vulnerabilities, and code quality issues.

Phase 1: Complete Input Gathering

Get the FULL diff: git diff master...HEAD
If output is truncated, read each changed file individually until you have seen every changed line
List all files modified in this branch before proceeding

Phase 2: Attack Surface Mapping

For each changed file, identify and list:

All user inputs (request params, headers, body, URL components)
All database queries
All authentication/authorization checks
All session/state operations
All external calls
All cryptographic operations

Phase 3: Security Checklist (check EVERY item for EVERY file)

Injection: SQL, command, template, header injection

Related Skills

Quick Install

Find Bugs

npx skillvault add davila7/davila7-claude-code-templates-cli-tool-components-skills-sentry-find-bugs-skill-md

Download Skill Open repository

Author: davila7
stars: 24,709
Updated: Jan 6, 2026
Occupation

On this page

01Phase 1: Complete Input Gathering

XSS: All outputs in templates properly escaped?

Authentication: Auth checks on all protected operations?

Authorization/IDOR: Access control verified, not just auth?

CSRF: State-changing operations protected?

Race conditions: TOCTOU in any read-then-write patterns?

Session: Fixation, expiration, secure flags?

Cryptography: Secure random, proper algorithms, no secrets in logs?

Information disclosure: Error messages, logs, timing attacks?

DoS: Unbounded operations, missing rate limits, resource exhaustion?

Business logic: Edge cases, state machine violations, numeric overflow?

Phase 4: Verification

For each potential issue:

Check if it's already handled elsewhere in the changed code
Search for existing tests covering the scenario
Read surrounding context to verify the issue is real

Phase 5: Pre-Conclusion Audit

Before finalizing, you MUST:

List every file you reviewed and confirm you read it completely
List every checklist item and note whether you found issues or confirmed it's clean
List any areas you could NOT fully verify and why
Only then provide your final findings

Output Format

Prioritize: security vulnerabilities > bugs > code quality

Skip: stylistic/formatting issues

For each issue:

File:Line - Brief description
Severity: Critical/High/Medium/Low
Problem: What's wrong
Evidence: Why this is real (not already fixed, no existing test, etc.)
Fix: Concrete suggestion
References: OWASP, RFCs, or other standards if applicable

If you find nothing significant, say so - don't invent issues.

Do not make changes - just report findings. I'll decide what to address.

02

Phase 2: Attack Surface Mapping

03Phase 3: Security Checklist (check EVERY item for EVERY file)

04Phase 4: Verification

05Phase 5: Pre-Conclusion Audit

06Output Format

Software Quality Assurance Analysts and Testers

Gh Issues

Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label bug] [--limit 5] [--milestone v1.0] [--assignee @me] [--fork user/repo] [--watch] [--interval 5] [--reviews-only] [--cron] [--dry-run] [--model glm-5] [--notify-channel -1002381931352]

Automation Tools

Coding Agent (bash-first)

Delegate coding tasks to Codex, Claude Code, or Pi agents via background process. Use when: (1) building/creating new features or apps, (2) reviewing PRs (spawn in temp dir), (3) refactoring large codebases, (4) iterative coding that needs file exploration. NOT for: simple one-liner fixes (just edit), reading code (use read tool), thread-bound ACP harness requests in chat (for example spawn/run Codex or Claude Code in a Discord thread; use sessions_spawn with runtime:"acp"), or any work in ~/clawd workspace (never spawn agents here). Claude Code: use --print --permission-mode bypassPermissions (no PTY). Codex/Pi/OpenCode: pty:true required.

Security Triage

Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to post and copy to clipboard.

Openclaw Ghsa Maintainer

Maintainer workflow for OpenClaw GitHub Security Advisories (GHSA). Use when Codex needs to inspect, patch, validate, or publish a repo advisory, verify private-fork state, prepare advisory Markdown or JSON payloads safely, handle GHSA API-specific publish constraints, or confirm advisory publish success.

Github

GitHub operations via `gh` CLI: issues, PRs, CI runs, code review, API queries. Use when: (1) checking PR status or CI, (2) creating/commenting on issues, (3) listing/filtering PRs or issues, (4) viewing run logs. NOT for: complex web UI interactions requiring manual browser flows (use browser tooling when available), bulk operations across many repos (script with gh api), or when gh auth is not configured.

Automation Tools

Fix

Use when you have lint errors, formatting issues, or before committing code to ensure it passes CI.

Software Quality Assurance Analysts and Testers