Agent Skills › codexstar69/bug-hunter › commit-security-scan

commit-security-scan

GitHub

用于扫描代码变更中的安全漏洞，支持PR、暂存区及分支差异分析。基于STRIDE模型识别Spoofing、Tampering等安全问题，生成符合Bug Hunter规范的发现报告，作为轻量级安全审查前置流程。

skills/commit-security-scan/SKILL.md codexstar69/bug-hunter

Trigger Scenarios

PR security review commit-diff scanning staged-change security checks branch-comparison security review pre-merge security analysis

Install

npx skills add codexstar69/bug-hunter --skill commit-security-scan -g -y

More Options

Use without installing

npx skills use codexstar69/bug-hunter@commit-security-scan

指定 Agent (Claude Code)

npx skills add codexstar69/bug-hunter --skill commit-security-scan -a claude-code -g -y

安装 repo 全部 skill

npx skills add codexstar69/bug-hunter --all -g -y

预览 repo 内 skill

npx skills add codexstar69/bug-hunter --list

SKILL.md

Frontmatter

{
    "name": "commit-security-scan",
    "description": "Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code."
}

Commit Security Scan

This is a bundled local Bug Hunter companion skill. It is portable and self-contained: use .bug-hunter/* artifacts, never .factory/* paths.

Purpose

Review changed code for security issues only. This skill is optimized for:

PR review
staged diff review
branch diff review
commit / commit-range security scanning

Inputs

Resolve the scan scope from the user request:

PR review → use scripts/pr-scope.cjs
staged review → use git diff --cached --name-only
branch diff → use git diff --name-only <base>...<head>
commit range → use git diff --name-only <base>..<head>

Workflow

Ensure threat-model context exists.
- Preferred artifacts:
  - .bug-hunter/threat-model.md
  - .bug-hunter/security-config.json
- If missing, run the bundled threat-model-generation skill first.
Resolve the changed-file scope.
Read the full contents of the changed source files, not just the patch.
Focus on STRIDE-oriented issues in changed code:
- Spoofing: auth/session/token mistakes
- Tampering: SQLi, XSS, path traversal, command injection, mass assignment
- Repudiation: security-sensitive actions with no auditability
- Information Disclosure: IDOR, secret exposure, verbose errors
- DoS: unbounded input, missing limits, expensive regex/queries
- Elevation of Privilege: missing authorization, role bypass, privilege escalation
Reuse Bug Hunter-native security conventions:
- findings should be compatible with .bug-hunter/hunter-findings.json
- use STRIDE + CWE labels
- include confidence scores
If the user wants only a focused security diff review, stop after the findings report. If the user wants deeper validation, hand off to the bundled vulnerability-validation skill.

Output

Preferred outputs:

.bug-hunter/hunter-findings.json when integrating with the main Bug Hunter pipeline
.bug-hunter/report.md as a rendered companion if needed

Notes

This skill is intentionally diff-scoped; it does not replace full-repository audits.
Use it as the lightweight security fast-path before invoking the broader security-review flow.

Version History

fa0cc06 Current 2026-08-16 08:02
修复端到端审计修复问题
8dedbbb 2026-07-24 16:56

Metadata

Files: 0
Version: fa0cc06
Hash: a4191322
Indexed: 2026-07-24 16:56

commit-security-scan