find-cve-agent

In the author's own words, from each skill's SKILL.md.

• advisory-mining

  Mine GitHub Security Advisories and CVE databases for incomplete fixes, finding variant vulnerabilities in patched code or similar patterns in related packages.

  skills/advisory-mining/SKILL.md on GitHub (opens in a new tab)

• auth-bypass

  Detect authentication and authorization bypass vulnerabilities including missing auth middleware, JWT algorithm confusion, IDOR, and session fixation.

  skills/auth-bypass/SKILL.md on GitHub (opens in a new tab)

• code-injection-codegen

  Detect code injection vulnerabilities in packages that dynamically generate or evaluate code via new Function(), eval(), vm.run*, or template literal interpolation.

  skills/code-injection-codegen/SKILL.md on GitHub (opens in a new tab)

• command-injection

  Detect OS command injection via shell execution sinks where user-controlled input reaches system commands without proper sanitization.

  skills/command-injection/SKILL.md on GitHub (opens in a new tab)

• cross-pollination

  Cross-pollination multiplier technique: find a vulnerability in one package, then search for the same pattern across all similar packages to multiply findings.

  skills/cross-pollination/SKILL.md on GitHub (opens in a new tab)

• decompression-bomb

  Detect decompression bomb vulnerabilities where compressed input can expand to exhaust memory, targeting buffer-based decompression without size limits.

  skills/decompression-bomb/SKILL.md on GitHub (opens in a new tab)

• entity-expansion

  Detect XML/SVG/YAML entity expansion (Billion Laughs) vulnerabilities in parsers that allow unbounded entity definitions.

  skills/entity-expansion/SKILL.md on GitHub (opens in a new tab)

• fp-check

  Systematic false positive elimination for security findings. 6-gate verification, 13-item checklist, devil's advocate questioning. MANDATORY before any CVE submission.

  skills/fp-check/SKILL.md on GitHub (opens in a new tab)

• jwt-attacks

  Detect JWT implementation vulnerabilities including algorithm confusion, none algorithm acceptance, weak secrets, and JWK injection attacks.

  skills/jwt-attacks/SKILL.md on GitHub (opens in a new tab)

• method-clobbering

  Detect method clobbering via user-controlled object keys that overwrite built-in methods like toString, valueOf, or hasOwnProperty, causing crashes or logic bypass.

  skills/method-clobbering/SKILL.md on GitHub (opens in a new tab)

• path-traversal

  Detect path traversal and Zip Slip vulnerabilities where user-controlled path components can escape intended directories.

  skills/path-traversal/SKILL.md on GitHub (opens in a new tab)

• prototype-pollution

  Detect prototype pollution via object merge/clone/assign operations where __proto__ or constructor.prototype keys can modify Object.prototype.

  skills/prototype-pollution/SKILL.md on GitHub (opens in a new tab)

• recursion-dos

  Detect stack overflow and infinite recursion DoS in recursive parsers, tree walkers, and serializers that lack depth limits.

  skills/recursion-dos/SKILL.md on GitHub (opens in a new tab)

• redos

  Detect Regular Expression Denial of Service (ReDoS) where crafted input causes catastrophic backtracking in regex patterns applied to user-controlled strings.

  skills/redos/SKILL.md on GitHub (opens in a new tab)

• report-writing

  Generate polished, human-sounding vulnerability disclosure reports for GHSA, HackerOne, and email. Auto-selects channel, calculates CVSS, and adapts tone.

  skills/report-writing/SKILL.md on GitHub (opens in a new tab)

• sandbox-escape

  Detect VM/sandbox escape vulnerabilities in packages using node:vm, simpleeval, or custom sandboxes that can be bypassed to achieve code execution.

  skills/sandbox-escape/SKILL.md on GitHub (opens in a new tab)

• sqli

  Detect SQL injection where user input reaches SQL query construction through string concatenation, template literals, or ORM raw query methods.

  skills/sqli/SKILL.md on GitHub (opens in a new tab)

• ssrf

  Detect Server-Side Request Forgery where user-controlled URLs can reach internal services, cloud metadata endpoints, or bypass network boundaries.

  skills/ssrf/SKILL.md on GitHub (opens in a new tab)

• ssti

  Detect Server-Side Template Injection where user input is passed as the template string itself rather than as template variables, enabling code execution.

  skills/ssti/SKILL.md on GitHub (opens in a new tab)

• target-recon

  Target discovery methodology for finding high-quality npm/PyPI/GitHub packages to audit for vulnerabilities, with evaluation criteria and search strategies.

  skills/target-recon/SKILL.md on GitHub (opens in a new tab)

• xxe

  Detect XML External Entity injection where XML parsers process untrusted input with external entity loading enabled, allowing file read or SSRF.

  skills/xxe/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 185k stars · 6 skills
• marketingskillsby coreyhaines31 Marketing skills for Claude Code and AI agents. CRO, copywriting, SEO, analytics, and growth engineering. 58.7k stars · 30 skills
• CowAgentby zhayujie Open-source personal AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-agent,… 47.8k stars · 3 skills
• guizang-ppt-skillby op7418 AI-agent Skill for generating polished HTML slide decks: editorial magazine and Swiss layouts, image prompts, social covers, and a WebGL/lo… 29.3k stars · 1 skill
• ai-guideby liyupi 程序员鱼皮的 AI 资源大全 + Vibe Coding 零基础教程，分享 OpenClaw 保姆级教程、大模型玩法（DeepSeek / GPT / Gemini / Claude / GLM）、最新 AI 资讯、Prompt 提示词大全、AI 知识百科（Agent Skil… 21.9k stars
• ego-liteby citrolabs The fastest browser for AI agents to run browser automation, built for sharing your logged-in browser state with your AI agents, like Codex… 21.8k stars · 3 skills