How do I install the Commit Security Scan skill?

Run npx skillmds@latest add codexstar69/commit-security-scan in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Commit Security Scan safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Commit Security Scan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Commit Security Scan free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Commit Security Scan?

codexstar69 (@codexstar69) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Commit Security Scan by codexstar69

Name: Commit Security Scan
Rating: 4.2 (5 reviews)
Author: codexstar69

Commit Security Scan

Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.

codexstar69 0fb0e87 2.5 KB Updated Sep 9, 2026

File contents

Commit Security Scan

This is a bundled local Bug Hunter companion skill. It is portable and self-contained: use .bug-hunter/* artifacts, never .factory/* paths.

Purpose

Review changed code for security issues only. This skill is optimized for:

PR review
staged diff review
branch diff review
commit / commit-range security scanning

Inputs

Resolve the scan scope from the user request:

PR review → use scripts/pr-scope.cjs
staged review → use git diff --cached --name-only
branch diff → use git diff --name-only <base>...<head>
commit range → use git diff --name-only <base>..<head>

Workflow

Ensure threat-model context exists.
- Preferred artifacts:
  - .bug-hunter/threat-model.md
  - .bug-hunter/security-config.json
- If missing, run the bundled threat-model-generation skill first.
Resolve the changed-file scope.
Read the full contents of the changed source files, not just the patch.
Focus on STRIDE-oriented issues in changed code:
- Spoofing: auth/session/token mistakes
- Tampering: SQLi, XSS, path traversal, command injection, mass assignment
- Repudiation: security-sensitive actions with no auditability
- Information Disclosure: IDOR, secret exposure, verbose errors
- DoS: unbounded input, missing limits, expensive regex/queries
- Elevation of Privilege: missing authorization, role bypass, privilege escalation
Reuse Bug Hunter-native security conventions:
- findings should be compatible with .bug-hunter/hunter-findings.json
- use STRIDE + CWE labels
- include confidence scores
If the user wants only a focused security diff review, stop after the findings report. If the user wants deeper validation, hand off to the bundled vulnerability-validation skill.

Output

Preferred outputs:

.bug-hunter/hunter-findings.json when integrating with the main Bug Hunter pipeline
.bug-hunter/report.md as a rendered companion if needed

Notes

This skill is intentionally diff-scoped; it does not replace full-repository audits.
Use it as the lightweight security fast-path before invoking the broader security-review flow.

---name: commit-security-scandescription: Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.--- # Commit Security Scan This is a bundled local Bug Hunter companion skill. It is portable and self-contained: use `.bug-hunter/*` artifacts, never `.factory/*` paths. ## Purpose Review *changed code* for security issues only. This skill is optimized for: - PR review - staged diff review - branch diff review - commit / commit-range security scanning ## Inputs Resolve the scan scope from the user request: - PR review → use `scripts/pr-scope.cjs` - staged review → use `git diff --cached --name-only` - branch diff → use `git diff --name-only <base>...<head>` - commit range → use `git diff --name-only <base>..<head>` ## Workflow 1. Ensure threat-model context exists. - Preferred artifacts: - `.bug-hunter/threat-model.md` - `.bug-hunter/security-config.json` - If missing, run the bundled `threat-model-generation` skill first. 2. Resolve the changed-file scope. 3. Read the full contents of the changed source files, not just the patch. 4. Focus on STRIDE-oriented issues in changed code: - Spoofing: auth/session/token mistakes - Tampering: SQLi, XSS, path traversal, command injection, mass assignment - Repudiation: security-sensitive actions with no auditability - Information Disclosure: IDOR, secret exposure, verbose errors - DoS: unbounded input, missing limits, expensive regex/queries - Elevation of Privilege: missing authorization, role bypass, privilege escalation 5. Reuse Bug Hunter-native security conventions: - findings should be compatible with `.bug-hunter/hunter-findings.json` - use STRIDE + CWE labels - include confidence scores 6. If the user wants only a focused security diff review, stop after the findings report. If the user wants deeper validation, hand off to the bundled `vulnerability-validation` skill. ## Output Preferred outputs: - `.bug-hunter/hunter-findings.json` when integrating with the main Bug Hunter pipeline - `.bug-hunter/report.md` as a rendered companion if needed ## Notes - This skill is intentionally diff-scoped; it does not replace full-repository audits. - Use it as the lightweight security fast-path before invoking the broader `security-review` flow.

Frequently asked questions

Commit Security Scan

File contents

Commit Security Scan

Purpose

Inputs

Workflow

Output

Notes

Related skills

Frequently asked questions

How do I install the Commit Security Scan skill?

What does the Commit Security Scan skill do?

Is Commit Security Scan safe to use?

Which AI agents work with Commit Security Scan?

Is Commit Security Scan free to use?

Who published Commit Security Scan?