skills.rest
antstanley
antstanleyCOMMUNITY
Explore all skills by this author →
GitHub

finding-discovery

Identifies plausible security vulnerability candidates in code diffs and repositories.

Updated May 4, 2026
Search Tags:#code review#security#vulnerability discovery#sast#cwe#threat model#diff scan
One-click install
npx skills add https://github.com/antstanley/skills --skill finding-discovery-antstanley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: finding-discovery
Source: https://github.com/antstanley/skills/tree/main/plugins/security/skills/finding-discovery
Command: npx skills add https://github.com/antstanley/skills --skill finding-discovery-antstanley

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security reviews often miss real vulnerabilities or drown in noise because reviewers lack a systematic way to enumerate candidate findings. This Skill investigates code changes or repositories for technically plausible vulnerabilities, producing structured, evidence-backed candidate findings that later validation and attack-path analysis phases can act on. ## Core Features & Use Cases - Diff-Scoped Discovery: Reviews PR, commit, branch, and local patch diffs, generating rank input and deep-review file lists deterministically while staying anchored to changed code. - Repository-Wide and Deep-Pass Modes: Supports exhaustive repository scans, scoped-path scans, and independent discovery passes within deep multi-pass security scans. - Family-Specific Rules: Applies detailed checklists for deserialization, SSRF, path traversal, auth/SSO/SAML, archive extraction, injection, and other vulnerability families. - Use Case: During a pull request security review, run this Skill to enumerate each plausible vulnerability candidate with its source, sink, broken control, and CWE taxonomy, writing ledger receipts so later phases can prove coverage. ## Quick Start Ask the AI to run the finding-discovery phase on the current pull request diff and list all plausible security vulnerability candidates with their evidence.

Frequently Asked Questions about finding-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find security vulnerabilities in a pull request diff?▼

Run the finding-discovery phase on the diff, which generates rank input from changed files, deep-reviews each file, and emits candidate findings with source, sink, and broken-control evidence. It stays anchored to changed code and directly supporting files.

What vulnerability types does security finding discovery cover?▼

It targets plausible candidates such as authorization bypass, confused deputy, SSRF, path traversal, injection with a real sink, cross-tenant data exposure, and trust-boundary escapes. Family-specific rules also cover deserialization, SAML/SSO, archive extraction, and command runners.

Can finding discovery run on a whole repository instead of a diff?▼

Yes, it supports repository-wide and scoped-path scans using a concise detection-first procedure, plus a deep-pass mode where an invoking workflow assigns a pass-local raw candidate output path. Diff scans and repository scans follow different workflows.

When should I not use finding discovery as the scan trigger?▼

Do not use it as the primary trigger for full PR, commit, branch, patch, or repository scans; those should start from the broader security scan workflow. Use it when a scan is already in its discovery phase or when explicitly asked to enumerate candidate findings.

Does finding discovery determine final vulnerability severity?▼

No, discovery only establishes technical plausibility and preserves evidence. Severity calibration and reportability decisions are deferred to the later attack-path analysis phase, which applies the severity policy.

Related Skills

Explore More Software Engineering Skills→
openaiopenai
5.3k

define-security-policy

Define and update SECURITY.md guidance for repository security scanning.

Official
Advanced
openaiopenai
5.3k

attack-path-analysis

Trace security findings from source to sink and calibrate severity against a threat model.

Official
Advanced
Xipher-LabsXipher-Labs
6

deepsec-integration

Run Vercel DeepSec semantic security scans on Walter-OS-tracked repositories.

Official
Advanced
winsorllcwinsorllc

code-review

Execute linters, static analysis, and security scanners on code.

Community
Intermediate