Vulnerability Hunter
AI security reviewers that read code and find what scanners miss.
An AI-assisted security reviewer for your own code and patches — it hunts business-logic flaws and unpatched variants, reproduces each finding in a sandbox, and reports root causes. Defensive use only: no exploits, no touching other people's systems.
Install it in 3 steps
No sign-up. No CLI tools. Pick your AI, copy one line, paste it over.
Prefer doing it yourself? Download the ZIP, unzip it into the directory shown above, restart your AI session — same result.
Real-world proof
Real people did this exact job with AI agents.
Hunt business-logic flaws and open fix PRs
Read case →Use caseHunt for unpatched vulnerabilities in SQLite commits
Read case →What’s inside
One SKILL.md (the playbook) + one starter template. A preview:
Vulnerability Hunter
When to use
- You want a second pair of eyes on your own codebase for business-logic flaws (broken access control, auth bypasses, bad state transitions) that scanners miss
- A vendor released a security patch and you want to understand what it actually fixed before applying it
- You want to check whether a known fixed bug has unpatched variants hiding elsewhere in the code
- Recent commits need review for vulnerability patterns before release
- You need a root-cause report on a suspected flaw, with reproduction steps — while you keep the fix and disclosure decisions
Workflow
You define exactly what gets reviewed: your repo, a module, a commit range. The skill only ever touches code you own or are authorized to test. Scope is human-set, always — this is a defensive skill, not a reconnaissance tool.
- Scope the review (input: your codebase or commit range → output: review scope)
AI reviewers read the code — in parallel across modules when the codebase is large — focusing on business logic: authorization checks, state transitions, trust boundaries. Not just known CVE patterns, but the "the code works as written, and that's the problem" class. Every finding at this stage is a candidate, not a verdict.
- Hunt for logic flaws (input: scoped code → output: candidate findings)
Every finding must be reproduced in an isolated sandbox before it's reported as real. Unreproduced findings are labeled unconfirmed, not dropped silently. This step is mandatory because AI security review has a high false-positive rate — reproduction is how the skill stays honest.
- Reproduce in a sandbox (input: candidate finding → output: reproduction result)
Write up what the flaw is, why it exists, the full attack path, and the reproduction steps. For patch-diff work: diff the patch to locate what was fixed, classify the bug, then search the codebase for the same pattern that the patch missed.
- Report the root cause (input: confirmed finding → output: root-cause report)
The AI drafts the patch and opens a pull request — you review and merge. After merging, the reproduction case is re-run to confirm the hole is actually closed, not just covered.
- Propose and verify the fix (input: report → output: fix PR + verification)
You decide the patching timeline, who gets told what, and when. The skill never publishes vulnerability details, never contacts third parties, and never tests anything outside your own isolated environment.
- Control disclosure (input: confirmed vulnerability → output: disclosure plan)
Output spec
- Per-finding report: severity, root cause, attack path, reproduction steps, sandbox evidence, suggested fix
- Fix PRs are drafted, never auto-merged; the reproduction case is re-
