Security Review

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 206587dd9725 · 16 Oct 2026Report an issue or request a re-scan

• Publishercodexstar69 GitHub userOwner of the repository this skill is read from
• Source foldercodexstar69/bug-hunter/skills/security-reviewThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict206587dd9725A new audit runs when the source changes
• Repository statusNot archivedLast push 60 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper…

---
name: security-review
description: Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.
---

# Security Review

This is a bundled local Bug Hunter companion skill. It packages a security-focused review workflow without introducing any external marketplace dependency.

## Purpose

Use this skill for deeper security audits than a simple bug hunt, especially when the user wants:
- a full security review
- PR security validation
- weekly security scanning
- dependency reachability + code review together
- threat-model-driven analysis

## Workflow

1. Ensure `.bug-hunter/threat-model.md` exists.
   - If missing, invoke the bundled `threat-model-generation` skill.

2. Determine the scan mode from the request:
   - PR → diff-scoped review via `commit-security-scan`
   - staged → staged-only security review
   - weekly → recent commit range on the default branch
   - full → full repository security audit

3. If dependency scanning is relevant, run:
   - `node scripts/dep-scan.cjs --target <path> --output .bug-hunter/dep-findings.json`

4. Scan code for STRIDE threats using Bug Hunter-native conventions.
   Reuse:
   - `.bug-hunter/triage.json`
   - `.bug-hunter/threat-model.md`
   - `.bug-hunter/security-config.json`
   - `.bug-hunter/dep-findings.json`

5. Validate severe findings using the bundled `vulnerability-validation` skill.

6. Produce structured outputs compatible with the Bug Hunter pipeline.

## Outputs

Primary artifacts should stay inside `.bug-hunter/`:
- `.bug-hunter/hunter-findings.json`
- `.bug-hunter/referee.json`
- `.bug-hunter/report.md`
- `.bug-hunter/dep-findings.json` when dependency review is enabled
- `.bug-hunter/fix-strategy.json` if the user wants remediation planning

## Important constraints

- Keep all paths Bug Hunter-native; do not emit `.factory/*` artifacts.
- Prefer validated, exploitability-aware findings over raw volume.
- For patching requests, hand findings back to the normal Bug Hunter fix pipeline rather than inventing a second patch system.

Excerpt, first 2,264 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/codexstar69/bug-hunter
git -C bug-hunter checkout 206587dd9725

Works in

1. 2026-10-16
   ✓SAFE B 89 / 100

   first audit · source 206587dd9725

Questions about Security Review

• github.com/codexstar69/bug-hunter/tree/main/skills/security-revi — the audited source at commit 206587dd9725 and every finding aboveObserved · 16 Oct 2026

Spotted something wrong? Report a correction · Methodology