aa71e76eb9
- Add date_added to all 950+ skills for complete tracking - Update version to 6.5.0 in package.json and README - Regenerate all indexes and catalog - Sync all generated files Features from merged PR #150: - Stars/Upvotes system for community-driven discovery - Auto-update mechanism via START_APP.bat - Interactive Prompt Builder - Date tracking badges - Smart auto-categorization All skills validated and indexed. Made-with: Cursor
88 lines
3.1 KiB
Markdown
88 lines
3.1 KiB
Markdown
---
|
|
name: find-bugs
|
|
description: "Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch."
|
|
risk: safe
|
|
source: "https://github.com/getsentry/skills/tree/main/plugins/sentry-skills/skills/find-bugs"
|
|
date_added: "2026-02-27"
|
|
---
|
|
|
|
# Find Bugs
|
|
|
|
Review changes on this branch for bugs, security vulnerabilities, and code quality issues.
|
|
|
|
## When to Use This Skill
|
|
|
|
Use this skill when:
|
|
- Asked to review changes
|
|
- Finding bugs in code
|
|
- Performing security reviews
|
|
- Auditing code on the current branch
|
|
- Reviewing pull request changes
|
|
|
|
## Phase 1: Complete Input Gathering
|
|
|
|
1. Get the FULL diff: `git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD`
|
|
2. If output is truncated, read each changed file individually until you have seen every changed line
|
|
3. List all files modified in this branch before proceeding
|
|
|
|
## Phase 2: Attack Surface Mapping
|
|
|
|
For each changed file, identify and list:
|
|
|
|
* All user inputs (request params, headers, body, URL components)
|
|
* All database queries
|
|
* All authentication/authorization checks
|
|
* All session/state operations
|
|
* All external calls
|
|
* All cryptographic operations
|
|
|
|
## Phase 3: Security Checklist (check EVERY item for EVERY file)
|
|
|
|
* [ ] **Injection**: SQL, command, template, header injection
|
|
* [ ] **XSS**: All outputs in templates properly escaped?
|
|
* [ ] **Authentication**: Auth checks on all protected operations?
|
|
* [ ] **Authorization/IDOR**: Access control verified, not just auth?
|
|
* [ ] **CSRF**: State-changing operations protected?
|
|
* [ ] **Race conditions**: TOCTOU in any read-then-write patterns?
|
|
* [ ] **Session**: Fixation, expiration, secure flags?
|
|
* [ ] **Cryptography**: Secure random, proper algorithms, no secrets in logs?
|
|
* [ ] **Information disclosure**: Error messages, logs, timing attacks?
|
|
* [ ] **DoS**: Unbounded operations, missing rate limits, resource exhaustion?
|
|
* [ ] **Business logic**: Edge cases, state machine violations, numeric overflow?
|
|
|
|
## Phase 4: Verification
|
|
|
|
For each potential issue:
|
|
|
|
* Check if it's already handled elsewhere in the changed code
|
|
* Search for existing tests covering the scenario
|
|
* Read surrounding context to verify the issue is real
|
|
|
|
## Phase 5: Pre-Conclusion Audit
|
|
|
|
Before finalizing, you MUST:
|
|
|
|
1. List every file you reviewed and confirm you read it completely
|
|
2. List every checklist item and note whether you found issues or confirmed it's clean
|
|
3. List any areas you could NOT fully verify and why
|
|
4. Only then provide your final findings
|
|
|
|
## Output Format
|
|
|
|
**Prioritize**: security vulnerabilities > bugs > code quality
|
|
|
|
**Skip**: stylistic/formatting issues
|
|
|
|
For each issue:
|
|
|
|
* **File:Line** - Brief description
|
|
* **Severity**: Critical/High/Medium/Low
|
|
* **Problem**: What's wrong
|
|
* **Evidence**: Why this is real (not already fixed, no existing test, etc.)
|
|
* **Fix**: Concrete suggestion
|
|
* **References**: OWASP, RFCs, or other standards if applicable
|
|
|
|
If you find nothing significant, say so - don't invent issues.
|
|
|
|
Do not make changes - just report findings. I'll decide what to address.
|