Auditing Code For Vulnerabilities
trilwu/secskills
Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis.
Run a focused STRIDE-based security review using Bug Hunter-native artifacts.
Install Security Review
$ npx skills add codexstar69/bug-hunter --skill security-review -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install codexstar69/bug-hunter security-review --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/codexstar69/bug-hunter.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/security-review .claude/skills/security-review && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-review" agent skill from https://github.com/codexstar69/bug-hunter/tree/main/skills/security-review into .claude/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/codexstar69/bug-hunter/tree/main/skills/security-reviewType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add codexstar69/bug-hunter --skill security-review -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install codexstar69/bug-hunter security-review --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/codexstar69/bug-hunter.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/security-review .agents/skills/security-review && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-review" agent skill from https://github.com/codexstar69/bug-hunter/tree/main/skills/security-review into .agents/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add codexstar69/bug-hunter --skill security-review -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install codexstar69/bug-hunter security-review --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/codexstar69/bug-hunter.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/security-review .cursor/skills/security-review && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-review" agent skill from https://github.com/codexstar69/bug-hunter/tree/main/skills/security-review into .cursor/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/codexstar69/bug-hunter.git --path skills/security-review--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add codexstar69/bug-hunter --skill security-review -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install codexstar69/bug-hunter security-review --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/codexstar69/bug-hunter.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/security-review .gemini/skills/security-review && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-review" agent skill from https://github.com/codexstar69/bug-hunter/tree/main/skills/security-review into .gemini/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install codexstar69/bug-hunter security-reviewInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add codexstar69/bug-hunter --skill security-review -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/codexstar69/bug-hunter.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/security-review .github/skills/security-review && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-review" agent skill from https://github.com/codexstar69/bug-hunter/tree/main/skills/security-review into .github/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add codexstar69/bug-hunter --skill security-review -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install codexstar69/bug-hunter security-review --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/codexstar69/bug-hunter.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/security-review .opencode/skills/security-review && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-review" agent skill from https://github.com/codexstar69/bug-hunter/tree/main/skills/security-review into .opencode/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-review- GitHub stars
- 519
- Token cost
- ~567 tokens
- SKILL.md length
- 209 words
- Files
- 1
- Skills in repo
- 11
- Repo updated
- First seen
- Licence
- MIT
At a glance
Run a focused STRIDE-based security review using Bug Hunter-native artifacts.
- Works in 6 steps: Ensure .bug-hunter/threat-model.md exists. → Determine the scan mode from the request → If dependency scanning is relevant, run → …
- The user asks for a full security audit
- SKILL.md covers Purpose, Workflow, Outputs and Important constraints
- Calls node
What it does
Security Review is an agent skill from codexstar69/bug-hunter. Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.
Its SKILL.md is about 570 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Security review and Threat modeling. The repository describes itself as: Adversarial AI bug hunter with auto-fix skill for Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI, Opencode, Pi Coding Agent, and more. Multi-agent pipeline finds… The licence is MIT.
When your agent uses it
- The user asks for a full security audit
- Repository security review
- Weekly security scan
- PR security review with deeper validation
Example prompts
- “/security-review”
Workflow steps
6 steps, taken from the first numbered list in SKILL.md.
- Ensure .bug-hunter/threat-model.md exists.
- Determine the scan mode from the request
- If dependency scanning is relevant, run
- Scan code for STRIDE threats using Bug Hunter-native conventions.
- Validate severe findings using the bundled vulnerability-validation skill.
- Produce structured outputs compatible with the Bug Hunter pipeline.
What it can do on your machine
Read from SKILL.md and the folder at commit 3be6973. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
node
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Review loads about 567 tokens when it runs. Until then it costs about 80 tokens; SKILL.md has 209 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from codexstar69/bug-hunter at commit 3be6973, republished under its MIT licence (© codexstar69). 209 words, ~567 tokens.
Download SKILL.mdSave it as
.claude/skills/security-review/SKILL.md (or your agent's skills folder).- name
- security-review
- description
- Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.
Security Review
This is a bundled local Bug Hunter companion skill. It packages a security-focused review workflow without introducing any external marketplace dependency.
Purpose
Use this skill for deeper security audits than a simple bug hunt, especially when the user wants:
- a full security review
- PR security validation
- weekly security scanning
- dependency reachability + code review together
- threat-model-driven analysis
Workflow
Ensure
.bug-hunter/threat-model.mdexists.- If missing, invoke the bundled
threat-model-generationskill.
- If missing, invoke the bundled
Determine the scan mode from the request:
- PR → diff-scoped review via
commit-security-scan - staged → staged-only security review
- weekly → recent commit range on the default branch
- full → full repository security audit
- PR → diff-scoped review via
If dependency scanning is relevant, run:
node scripts/dep-scan.cjs --target <path> --output .bug-hunter/dep-findings.json
Scan code for STRIDE threats using Bug Hunter-native conventions. Reuse:
.bug-hunter/triage.json.bug-hunter/threat-model.md.bug-hunter/security-config.json.bug-hunter/dep-findings.json
Validate severe findings using the bundled
vulnerability-validationskill.Produce structured outputs compatible with the Bug Hunter pipeline.
Outputs
Primary artifacts should stay inside .bug-hunter/:
.bug-hunter/hunter-findings.json.bug-hunter/referee.json.bug-hunter/report.md.bug-hunter/dep-findings.jsonwhen dependency review is enabled.bug-hunter/fix-strategy.jsonif the user wants remediation planning
Important constraints
- Keep all paths Bug Hunter-native; do not emit
.factory/*artifacts. - Prefer validated, exploitability-aware findings over raw volume.
- For patching requests, hand findings back to the normal Bug Hunter fix pipeline rather than inventing a second patch system.
© codexstar69, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/security-review of codexstar69/bug-hunter.
Open the folder on GitHubat commit 3be6973
Compare with similar skills
Security Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Review this skillcodexstar69/bug-hunter | 519 | — | ~567 | Automated safety check: Pass | MIT | |
| Auditing Code For Vulnerabilitiestrilwu/secskills | 156 | — | ~3.2k | Automated safety check: Pass | MIT | |
| Audit Browser Security Boundariesnordstjernen-web/northstar-browser | 112 | — | ~920 | Automated safety check: Pass | GPL-3.0 | |
| Threat Mitigation Mappingwshobson/agents | 40k | 7 repos | ~742 | Automated safety check: Pass | MIT | |
| Security Auditblueberrycongee/termcanvas | 406 | — | ~966 | Automated safety check: Notes | MIT | |
| Commit Security ScanFactory-AI/factory-plugins | 110 | — | ~2.3k | Automated safety check: Pass | None |
Similar skills
Audit Browser Security Boundaries
nordstjernen-web/northstar-browser
Audit browser-engine changes that process untrusted content or cross native-memory, origin, network, storage, extension, decoder, sandbox, or operating-system boundaries.
Threat Mitigation Mapping
wshobson/agents
Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation.
Security Audit
blueberrycongee/termcanvas
Security audit skill. An agent skill from blueberrycongee/termcanvas.
Commit Security Scan
Factory-AI/factory-plugins
Analyze code changes for security vulnerabilities using LLM reasoning and threat model patterns.
Security Hardening
ancoleman/ai-design-components
Reduces attack surface across OS, container, cloud, network, and database layers using CIS Benchmarks and zero-trust principles.
More from codexstar69/bug-hunter
All 11 skills in this repoBug Hunter
codexstar69/bug-hunter
Precision-first adversarial bug hunting for runtime, logic, data, concurrency, and security defects.
Commit Security Scan
codexstar69/bug-hunter
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.
Doc Lookup
codexstar69/bug-hunter
Unified documentation lookup for Bug Hunter agents. An agent skill from codexstar69/bug-hunter.
Fixer
codexstar69/bug-hunter
Surgical code fixer for Bug Hunter. An agent skill from codexstar69/bug-hunter.
Hunter
codexstar69/bug-hunter
Deep behavioral code analysis agent for Bug Hunter. An agent skill from codexstar69/bug-hunter.
Recon
codexstar69/bug-hunter
Codebase reconnaissance agent for Bug Hunter. An agent skill from codexstar69/bug-hunter.
Related
Categories
Questions about Security Review
What does Security Review do?
Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Security Review is an agent skill from codexstar69/bug-hunter. Run a focused STRIDE-based security review using Bug Hunter-native artifacts.
When should I use Security Review?
Security Review fits situations like: the user asks for a full security audit; repository security review; weekly security scan; PR security review with deeper validation.
How do I install Security Review in Claude Code?
Run `npx skills add codexstar69/bug-hunter --skill security-review -a claude-code`. Or copy the skill folder (skills/security-review in codexstar69/bug-hunter) into .claude/skills/security-review in your project. Claude Code loads it when a task matches its description.
How do I install Security Review in Codex?
Run `npx skills add codexstar69/bug-hunter --skill security-review -a codex`. Or copy the skill folder (skills/security-review in codexstar69/bug-hunter) into .agents/skills/security-review in your project. Codex loads it when a task matches its description.
Can I use Security Review in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add codexstar69/bug-hunter --skill security-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-review, .gemini/skills/security-review, .github/skills/security-review and .opencode/skills/security-review in your project.
What does Security Review need to run?
Going by SKILL.md and its folder, Security Review needs the command-line tools its instructions call (node).
Does Security Review access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Security Review safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Review use?
Security Review is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Review use?
About 567 tokens (SKILL.md is roughly 2.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Review?
Skills that share tags, products or a category with Security Review: Auditing Code For Vulnerabilities (trilwu/secskills, 156 stars), Audit Browser Security Boundaries (nordstjernen-web/northstar-browser, 112 stars), Threat Mitigation Mapping (wshobson/agents, 40k stars) and Security Audit (blueberrycongee/termcanvas, 406 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Review?
codexstar69 (a GitHub user) maintains it in codexstar69/bug-hunter, which has 519 GitHub stars. The repository holds 11 skills in this directory. The repository was last updated on August 17, 2026.
Source: codexstar69/bug-hunter on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.