Agent Skills › codexstar69/bug-hunter › security-review

security-review

GitHub

基于STRIDE模型执行深度安全审计，支持PR、周扫描及全仓库审查。整合依赖CVE与威胁建模，验证漏洞并生成结构化报告，辅助修复规划。

skills/security-review/SKILL.md codexstar69/bug-hunter

Trigger Scenarios

用户请求完整安全审计 PR安全检查每周安全扫描依赖漏洞分析

Install

npx skills add codexstar69/bug-hunter --skill security-review -g -y

More Options

Use without installing

npx skills use codexstar69/bug-hunter@security-review

指定 Agent (Claude Code)

npx skills add codexstar69/bug-hunter --skill security-review -a claude-code -g -y

安装 repo 全部 skill

npx skills add codexstar69/bug-hunter --all -g -y

预览 repo 内 skill

npx skills add codexstar69/bug-hunter --list

SKILL.md

Frontmatter

{
    "name": "security-review",
    "description": "Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow."
}

Security Review

This is a bundled local Bug Hunter companion skill. It packages a security-focused review workflow without introducing any external marketplace dependency.

Purpose

Use this skill for deeper security audits than a simple bug hunt, especially when the user wants:

a full security review
PR security validation
weekly security scanning
dependency reachability + code review together
threat-model-driven analysis

Workflow

Ensure .bug-hunter/threat-model.md exists.
- If missing, invoke the bundled threat-model-generation skill.
Determine the scan mode from the request:
- PR → diff-scoped review via commit-security-scan
- staged → staged-only security review
- weekly → recent commit range on the default branch
- full → full repository security audit
If dependency scanning is relevant, run:
- node scripts/dep-scan.cjs --target <path> --output .bug-hunter/dep-findings.json
Scan code for STRIDE threats using Bug Hunter-native conventions. Reuse:
- .bug-hunter/triage.json
- .bug-hunter/threat-model.md
- .bug-hunter/security-config.json
- .bug-hunter/dep-findings.json
Validate severe findings using the bundled vulnerability-validation skill.
Produce structured outputs compatible with the Bug Hunter pipeline.

Outputs

Primary artifacts should stay inside .bug-hunter/:

.bug-hunter/hunter-findings.json
.bug-hunter/referee.json
.bug-hunter/report.md
.bug-hunter/dep-findings.json when dependency review is enabled
.bug-hunter/fix-strategy.json if the user wants remediation planning

Important constraints

Keep all paths Bug Hunter-native; do not emit .factory/* artifacts.
Prefer validated, exploitability-aware findings over raw volume.
For patching requests, hand findings back to the normal Bug Hunter fix pipeline rather than inventing a second patch system.