Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
Evidence: Why this is real (not already fixed, no existing test, etc.)
Fix: Concrete suggestion
References: OWASP, RFCs, or other standards if applicable
If you find nothing significant, say so - don't invent issues.
Do not make changes - just report findings. I'll decide what to address.
1---2name: find-bugs3description: Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.4---56# Find Bugs78Review changes on this branch for bugs, security vulnerabilities, and code quality issues.910## Phase 1: Complete Input Gathering11121. Get the FULL diff: `git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD`132. If output is truncated, read each changed file individually until you have seen every changed line143. List all files modified in this branch before proceeding1516## Phase 2: Attack Surface Mapping1718For each changed file, identify and list:1920* All user inputs (request params, headers, body, URL components)21* All database queries22* All authentication/authorization checks23* All session/state operations24* All external calls25* All cryptographic operations2627## Phase 3: Security Checklist (check EVERY item for EVERY file)2829* [ ] **Injection**: SQL, command, template, header injection30* [ ] **XSS**: All outputs in templates properly escaped?31* [ ] **Authentication**: Auth checks on all protected operations?32* [ ] **Authorization/IDOR**: Access control verified, not just auth?33* [ ] **CSRF**: State-changing operations protected?34* [ ] **Race conditions**: TOCTOU in any read-then-write patterns?35* [ ] **Session**: Fixation, expiration, secure flags?36* [ ] **Cryptography**: Secure random, proper algorithms, no secrets in logs?37* [ ] **Information disclosure**: Error messages, logs, timing attacks?38* [ ] **DoS**: Unbounded operations, missing rate limits, resource exhaustion?39* [ ] **Business logic**: Edge cases, state machine violations, numeric overflow?4041## Phase 4: Verification4243For each potential issue:4445* Check if it's already handled elsewhere in the changed code46* Search for existing tests covering the scenario47* Read surrounding context to verify the issue is real4849## Phase 5: Pre-Conclusion Audit5051Before finalizing, you MUST:52531. List every file you reviewed and confirm you read it completely542. List every checklist item and note whether you found issues or confirmed it's clean553. List any areas you could NOT fully verify and why564. Only then provide your final findings5758## Output Format5960**Prioritize**: security vulnerabilities > bugs > code quality6162**Skip**: stylistic/formatting issues6364For each issue:6566* **File:Line** - Brief description67* **Severity**: Critical/High/Medium/Low68* **Problem**: What's wrong69* **Evidence**: Why this is real (not already fixed, no existing test, etc.)70* **Fix**: Concrete suggestion71* **References**: OWASP, RFCs, or other standards if applicable7273If you find nothing significant, say so - don't invent issues.7475Do not make changes - just report findings. I'll decide what to address.
Run npx skillmds@latest add mit-network/find-bugs in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch. It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
mit-network (@mit-network) published this skill. Their other Agent Skills are listed on their SkillMD profile.
mit-network