Commit Security Scan
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.
Install
$ agentstack add skill-codexstar69-bug-hunter-commit-security-scan ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-codexstar69-bug-hunter-commit-security-scan) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Commit Security Scan
This is a bundled local Bug Hunter companion skill. It is portable and self-contained: use .bug-hunter/* artifacts, never .factory/* paths.
Purpose
Review changed code for security issues only. This skill is optimized for:
- PR review
- staged diff review
- branch diff review
- commit / commit-range security scanning
Inputs
Resolve the scan scope from the user request:
- PR review → use
scripts/pr-scope.cjs - staged review → use
git diff --cached --name-only - branch diff → use
git diff --name-only ... - commit range → use
git diff --name-only ..
Workflow
- Ensure threat-model context exists.
- Preferred artifacts:
.bug-hunter/threat-model.md.bug-hunter/security-config.json- If missing, run the bundled
threat-model-generationskill first.
- Resolve the changed-file scope.
- Read the full contents of the changed source files, not just the patch.
- Focus on STRIDE-oriented issues in changed code:
- Spoofing: auth/session/token mistakes
- Tampering: SQLi, XSS, path traversal, command injection, mass assignment
- Repudiation: security-sensitive actions with no auditability
- Information Disclosure: IDOR, secret exposure, verbose errors
- DoS: unbounded input, missing limits, expensive regex/queries
- Elevation of Privilege: missing authorization, role bypass, privilege escalation
- Reuse Bug Hunter-native security conventions:
- findings should be compatible with
.bug-hunter/findings.json - use STRIDE + CWE labels
- include confidence scores
- If the user wants only a focused security diff review, stop after the findings report.
If the user wants deeper validation, hand off to the bundled vulnerability-validation skill.
Output
Preferred outputs:
.bug-hunter/findings.jsonwhen integrating with the main Bug Hunter pipeline.bug-hunter/report.mdas a rendered companion if needed
Notes
- This skill is intentionally diff-scoped; it does not replace full-repository audits.
- Use it as the lightweight security fast-path before invoking the broader
security-reviewflow.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: codexstar69
- Source: codexstar69/bug-hunter
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.