Vuln Scanner

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: critical finding, no behavioural pass, undeclared transfer.

- **`403 "Repository does not have private vulnerability reporting enabled"`** → PVR is OFF on the repo. This is **not** a token-scope problem (classic `repo` scope is enough). **Critically: the GitHu

Audit 0.4.1 · source sha 0448e87653f9 · 14 Oct 2026Report an issue or request a re-scan

• Publisheraaronjmars GitHub organizationOwner of the repository this skill is read from
• Source folderaaronjmars/aeon/skills/vuln-scannerThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict0448e87653f9A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Audit trending repos for real security vulnerabilities and disclose responsibly - scan and route findings (PVR / dependency PR), re-submit queued advisories, and send armed email disclosures

---
name: vuln-scanner
description: Audit trending repos for real security vulnerabilities and disclose responsibly - scan and route findings (PVR / dependency PR), re-submit queued advisories, and send armed email disclosures
metadata:
  title: Vuln Scanner
  category: dev
  var: ""
  tags:
    - dev
    - security
    - meta
  depends_on:
    - github-trending
  requires:
    - GH_GLOBAL?
    - RESEND_API_KEY?
    - RESEND_FROM?
    - RESEND_REPLY_TO?
---
<!-- autoresearch: variation B — responsible-disclosure-first: private reports for code vulns, public PRs only for already-disclosed dep CVEs -->

> **${var}** — Action selector, shaped `[<action>][:<owner/repo>]`. Empty or a bare `owner/repo` → **scan** arm (audit that repo, or auto-select a trending one). `resubmit` / `resubmit:owner/repo` → **re-submit** arm (probe the security watchlist for repos that just enabled PVR and submit any queued advisory). `disclose` / `email` → **disclose** arm (queue armed out-of-band email disclosures for sending). Examples:
> - `` → scan, auto-select from trending
> - `openai/whisper` → scan `openai/whisper`
> - `resubmit` → probe the whole watchlist and re-submit what flipped
> - `resubmit:vercel/next.js` → probe just that repo (one-off)
> - `disclose` (alias `email`) → arm & queue eligible disclosure emails
> - `poc-smoke` → exercise the PoC gate against a benign real Base fork (no audit or disclosure)
> - `riva:owner/repo` → scan with the Riva research kernel (shadow/proposal only)

Today is ${today}. Read `memory/MEMORY.md` and the last 30 days of `memory/logs/` before starting.

## Why this skill exists

This is the **write / action arm of the vuln-disclosure loop** — one skill covering the full responsible-disclosure lifecycle:

- **Scan** — a security scanner that dumps unpatched vulnerabilities into public PRs is a zero-day publisher, not a helper. This skill matches industry practice: **Private Vulnerability Reporting (PVR) for code flaws, public PRs only for dependency CVEs that are already public**. Bad disclosure burns credibility and puts users at risk.
- **Re-submit** — when a scan finds a HIGH/CRITICAL issue in a repo with no PVR, no `SECURITY.md`, and no reachable contact, it has no safe channel — so it logs the finding as `"channel": "skipped"` in `memory/vuln-scanned.json` and stages a watchlist row. Without a weekly probe those findings silently age until the responsible-disclosure window closes. The re-submit arm closes that loop.
- **Disclose** — when the only responsible path is a private email to the maintainer, drafts sit in `memory/pending-disclosures/` with `status: pending-operator-send`, waiting for a human. The disclose arm finds drafts **explicitly armed for auto-send**, composes the email, and **sends it in-run** (Resend via `./secretcurl`) behind a set of fail-closed caps — the send is the arm's final action.

## Dispatch — parse `${var}`, then run one arm

Parse the selector once, then jump to the matching arm below:

```bash
SEL="${var}"                     # the raw selector
ACTION="${SEL%%:*}"              # token before ':' (or the whole thing)
TARGET="${SEL#*:}"; [ "$TARGET" = "$SEL" ] && TARGET=""   # token after ':' (empty if no ':')

case "$ACTION" in
  resubmit|watchlist|pvr)   ARM="resubmit" ;;            # → Arm B
  disclose|email)           ARM="disclose" ;;            # → Arm C
  poc-smoke|verify-gate)    ARM="poc-smoke" ;;           # → Arm D
  riva|research)            ARM="scan"; KERNEL="riva" ;; # → Arm A, Riva kernel
  shadow|compare)           ARM="scan"; KERNEL="shadow" ;; # → Arm A, private comparison
  ""|scan)                  ARM="scan" ;;                # → Arm A (auto-select if TARGET empty)
  */*)                      ARM="scan"; TARGET="$SEL" ;; # bare owner/repo → scan that repo
  *)                        ARM="scan" ;;                # unknown → default to scan
esac

# Legacy remains the safe default while Riva is evaluated. `shadow` produces a
# private comparison artifact; only an explicit `riva` selector or a reviewed
# environment override selects it for a scan. Neither mode changes disclosure
# authority or bypasses A4/A4.5.
KERNEL="${KERNEL:-${VULN_RESEARCH_KERNEL:-legacy}}"
case "$KERNEL" in legacy|shadow|riva) ;; *) KERNEL="legacy" ;; esac
```

- `ARM=scan` → **Arm A — SCAN** (target = `$TARGET`, or auto-select if empty).
- `ARM=resubmit` → **Arm B — RE-SUBMIT** (probe `$TARGET` if set, else the whole watchlist).
- `ARM=disclose` → **Arm C — DISCLOSE** (queue armed email drafts).
- `ARM=poc-smoke` → **Arm D — PoC GATE SMOKE** (benign live-fork verification only).

Each arm is independently executable. The operational arms share the same GitHub token and the same `memory/` state (`vuln-scanned.json`, `security-watchlist.md`, `pending-disclosures/`, `email-log.json`) — that shared state is exactly how the arms hand off to each other. The smoke arm does not read or modify that state.

---

## Arm A — SCAN

Find one trending repo, run purpose-built scanners (not raw grep), triage to real exploitable findings, and route each finding to the correct disclosure channel — PVR, `SECURITY.md` contact, or dependency-bump PR.

### A1. Pick a target

If `$TARGET` is set, use it. Otherwise:

```bash
# Prefer chained output from github-trending skill
CANDS=""
if [ -s output/.chains/github-trending.md ]; then
  # Parse owner/repo targets. Accept BOTH the markdown form [owner/repo](url) and a
  # bare github.com/owner/repo permalink (a feeder degraded under read-only can emit
  # the latter). A repo name with no owner is NOT a candidate. Pick the first CANDS
  # entry that matches the criteria below.
  CANDS=$(grep -oE '\[[^]]+/[^]]+\]\(https?://[^)]+\)|https?://github\.com/[^/ )]+/[^/ )]+' output/.chains/github-trending.md \
    | sed -E 's#.*github\.com/##; s#\).*##; s#^\[##; s#\].*##' | grep -E '^[^/ ]+/[^/ ]+$' | sort -u)
fi
# If the feed was absent OR present-but-unparseable (zero owner/repo lines, e.g. a
# header-only / prose-only notify bod

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-14
   ✕BLOCK D 69 / 100

   first audit · source 0448e87653f9

Questions about Vuln Scanner

• github.com/aaronjmars/aeon/tree/main/skills/vuln-scanner — the audited source at commit 0448e87653f9 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology