Find Bugs

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

1,102 stars 62 forksSecurityOfficial

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add getsentry/skills --skill find-bugs

Manual install

git clone --depth 1 https://github.com/getsentry/skills.git /tmp/skills
mkdir -p ~/.claude/skills
cp -r /tmp/skills/skills/find-bugs ~/.claude/skills/find-bugs

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Find Bugs

Review changes on this branch for bugs, security vulnerabilities, and code quality issues.

## Phase 1: Complete Input Gathering

1. Get the FULL diff: `git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD`
2. If output is truncated, read each changed file individually until you have seen every changed line
3. List all files modified in this branch before proceeding

## Phase 2: Attack Surface Mapping

For each changed file, identify and list:

* All user inputs (request params, headers, body, URL components)
* All database queries
* All authentication/authorization checks
* All session/state operations
* All external calls
* All cryptographic operations

## Phase 3: Security Checklist (check EVERY item for EVERY file)

* [ ] **Injection**: SQL, command, template, header injection
* [ ] **XSS**: All outputs in templates properly escaped?
* [ ] **Authentication**: Auth checks on all protected operations?
* [ ] **Authorization/IDOR**: Access control verified, not just auth?
* [ ] **CSRF**: State-changing operations protected?
* [ ] **Race conditions**: TOCTOU in any read-then-write patterns?
* [ ] **Session**: Fixation, expiration, secure flags?
* [ ] **Cryptography**: Secure random, proper algorithms, no secrets in logs?
* [ ] **Information disclosure**: Error messages, logs, timing attacks?
* [ ] **DoS**: Unbounded operations, missing rate limits, resource exhaustion?

Read the full skill on GitHub

Details

Skill name: find-bugs
Repository: getsentry/skills
Path: skills/find-bugs/SKILL.md
License: Apache-2.0
Repo updated: 26 October 2026
Listed in: heilcheng/awesome-agent-skills

FAQ

What does the Find Bugs skill do?

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

How do I install the Find Bugs skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add getsentry/skills --skill find-bugs. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Find Bugs popular?

It lives in getsentry/skills, which has 1,102 GitHub stars and 62 forks, and is included in 1 curated skill list.

Related skills

Agents Md

1.1k

getsentry/skills

Creates and maintains concise AGENTS.md and CLAUDE.md project instruction files. Use when asked to create AGENTS.md, update AGENTS.md, maintain agent docs, set up CLAUDE.md, document repository agent conventions, or keep coding-agent instructions minimal and reference-backed.

AI, LLMs & AgentsIn 1 list62

Code Review

1.1k

getsentry/skills

Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.

Software DevelopmentIn 1 list62

Security Guide

139

jnMetaCode/shellward

OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation

SecurityIn 1 list23

VibeSec Skill

1.4k

BehiSecc/VibeSec-Skill

This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.

SecurityIn 2 lists122

Claude Pentest Skills

frendysanusi/claude-pentest-skills

Structured web application penetration testing with OWASP methodology, curated payload references, 6-gate validation, and professional report generation

Security12

Tirith

2.8k

sheeki03/tirith

Terminal security analysis for shell environments. This skill should be used when checking commands for supply-chain attacks before execution, scanning repositories for hidden content or config poisoning, scoring URLs for homograph attacks, setting up AI tool protection, inspecting Python package artifacts, governing untrusted tasks or Web3 commands, auditing browser extensions, creating provenance receipts, downloading and executing scripts safely, investigating why tirith blocked a command, managing trusted patterns, running security audits, configuring MCP gateway proxies, or working with t

Security104

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.