Security Review

codexstar69/bug-hunter/skills/security-review

by codexstar693be69733a27aa04d4f5620df203c05350d162067No license519 starsListed Oct 9, 2026Updated Oct 9, 2026Repository updated 7 weeks ago

Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.

Instructions onlySecurity
AI-generated overview

Runs a STRIDE-based security review of a repository, combining threat-model context, code scanning and dependency findings.

What it does
This skill guides a security-focused review workflow that scans code for STRIDE threats and combines threat-model context with dependency findings. It supports several scan modes, including pull-request diffs, staged changes, weekly commit ranges and full repository audits. It validates severe findings and writes structured artifacts such as hunter-findings.json, referee.json, report.md and optional fix-strategy.json into a .bug-hunter directory.
When to use it
Use it when the user asks for a full security audit, a repository or PR security review, a weekly security scan, or wants dependency CVEs and threat-model context combined in one workflow. It is intended for deeper audits than a simple bug hunt.
Requirements
Requires the Bug Hunter companion environment, including a .bug-hunter directory with threat-model.md, triage.json and security-config.json, plus the bundled threat-model-generation and vulnerability-validation skills. Dependency scanning uses node scripts/dep-scan.cjs. The skill itself ships no scripts and is instructions only.

Security Review

This is a bundled local Bug Hunter companion skill. It packages a security-focused review workflow without introducing any external marketplace dependency.

Purpose

Use this skill for deeper security audits than a simple bug hunt, especially when the user wants:

  • a full security review
  • PR security validation
  • weekly security scanning
  • dependency reachability + code review together
  • threat-model-driven analysis

Workflow

  1. Ensure .bug-hunter/threat-model.md exists.

    • If missing, invoke the bundled threat-model-generation skill.

  2. Determine the scan mode from the request:

    • PR → diff-scoped review via commit-security-scan
    • staged → staged-only security review
    • weekly → recent commit range on the default branch
    • full → full repository security audit

  3. If dependency scanning is relevant, run:

    • node scripts/dep-scan.cjs --target <path> --output .bug-hunter/dep-findings.json

  4. Scan code for STRIDE threats using Bug Hunter-native conventions. Reuse:

    • .bug-hunter/triage.json
    • .bug-hunter/threat-model.md
    • .bug-hunter/security-config.json
    • .bug-hunter/dep-findings.json

  5. Validate severe findings using the bundled vulnerability-validation skill.

  6. Produce structured outputs compatible with the Bug Hunter pipeline.

Outputs

Primary artifacts should stay inside .bug-hunter/:

  • .bug-hunter/hunter-findings.json
  • .bug-hunter/referee.json
  • .bug-hunter/report.md
  • .bug-hunter/dep-findings.json when dependency review is enabled
  • .bug-hunter/fix-strategy.json if the user wants remediation planning

Important constraints

  • Keep all paths Bug Hunter-native; do not emit .factory/* artifacts.
  • Prefer validated, exploitability-aware findings over raw volume.
  • For patching requests, hand findings back to the normal Bug Hunter fix pipeline rather than inventing a second patch system.

Source and attribution

Source:codexstar69/bug-hunterinskills/security-reviewat commit3be6973

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from codexstar69/bug-hunter

Vulnerability Validation

codexstar69

Validates suspected security findings for reachability, exploitability and real-world impact, producing CVSS scores and proof-of-concept notes.

Security519updated 7 weeks ago

Threat Model Generation

codexstar69

Generates a STRIDE-based threat model and matching security config for a repository under .bug-hunter/.

Security519updated 7 weeks ago

Skeptic

codexstar69

Adversarially reviews reported bugs to confirm or dismiss them as false positives, writing a JSON verdict file.

Software Development519updated 7 weeks ago

Referee

codexstar69

Final arbiter that independently verifies bug-hunter findings and skeptic challenges, issuing verdicts with severity and security enrichment.

Security519updated 7 weeks ago

Recon

codexstar69

Maps a codebase's architecture and risk areas to guide bug hunting, without finding bugs itself.

Security519updated 7 weeks ago

Hunter

codexstar69

Multi-phase behavioral code analysis agent that finds logic errors, security vulnerabilities, race conditions and runtime bugs.

Security519updated 7 weeks ago

More in Security

Kyc Rules

anthropics

Featured

Applies a firm's KYC/AML rules grid to a parsed onboarding record, scoring risk and routing outcomes.

Security39Kupdated 2 weeks ago

Kyc Rules

anthropics

Featured

Applies a firm's KYC/AML rules grid to a parsed onboarding record, scoring risk and routing outcomes.

Security39Kupdated 2 weeks ago

Compliance Tracking

anthropics

Featured

Tracks compliance requirements, audit readiness, and evidence for frameworks such as SOC 2, ISO 27001, GDPR, HIPAA, and PCI DSS.

Security27Kupdated today

Dpop Adoption

google

Featured

Guides implementation of OAuth 2.0 DPoP (RFC 9449) sender-constrained refresh tokens for Google's OAuth platform.

Security21Kupdated yesterday

Secops Triage

google

Featured

Guides SOC analysts through triaging Google SecOps security alerts, from investigation to closure or escalation.

Security21Kupdated yesterday

Secops Investigate

google

Featured

Guides SOC analysts through deep security incident and entity investigations in Google SecOps using UDM queries and timelines.

Security21Kupdated yesterday