Code Vulnerability Review

Use this skill after engagement-scope has established the authorized target, scope evidence, impact tolerance, and desired deliverable. If no engagement brief is present, infer the local/read-only scope from the provided repository or ask only for the missing boundary that changes the review.

Review Modes

Choose one primary mode:

• Broad audit: review a codebase or subsystem for likely vulnerability classes.
• Targeted class review: focus on one class such as IDOR, SSRF, injection, deserialization, upload handling, or secrets exposure.
• Patch review: inspect a diff for introduced, fixed, or bypassable security behavior.
• Finding validation: decide whether a suspected issue is reachable, exploitable, duplicate, or mitigated.
• Remediation: implement a minimal fix and tests for a confirmed issue.
• Report prep: turn evidence into a clear bounty, advisory, or internal security report.

Workflow