Skip to main content Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
npx skills add sickn33/antigravity-awesome-skills --skill find-bugs agentic-skills ai-agents antigravity claude-code mcp ai-workflows
Find Bugs
Review changes on this branch for bugs, security vulnerabilities, and code quality issues.
When to Use
You need a review focused on bugs, security issues, or risky code changes.
The task involves auditing the current branch diff rather than implementing new behavior.
You want a structured review process with checklist-driven verification against changed files.
Phase 1: Complete Input Gathering
Get the FULL diff: git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD
If output is truncated, read each changed file individually until you have seen every changed line
List all files modified in this branch before proceeding
Phase 2: Attack Surface Mapping
For each changed file, identify and list:
All user inputs (request params, headers, body, URL components)
All database queries
All authentication/authorization checks
All session/state operations
All external calls
All cryptographic operations
Phase 3: Security Checklist (check EVERY item for EVERY file)
Authorization/IDOR : Access control verified, not just auth?
CSRF : State-changing operations protected?
Race conditions : TOCTOU in any read-then-write patterns?
Session : Fixation, expiration, secure flags?
Cryptography : Secure random, proper algorithms, no secrets in logs?
Information disclosure : Error messages, logs, timing attacks?
DoS : Unbounded operations, missing rate limits, resource exhaustion?
Business logic : Edge cases, state machine violations, numeric overflow?
Phase 4: Verification For each potential issue:
Check if it's already handled elsewhere in the changed code
Search for existing tests covering the scenario
Read surrounding context to verify the issue is real
Phase 5: Pre-Conclusion Audit Before finalizing, you MUST:
List every file you reviewed and confirm you read it completely
List every checklist item and note whether you found issues or confirmed it's clean
List any areas you could NOT fully verify and why
Only then provide your final findings
Output Format Prioritize : security vulnerabilities > bugs > code quality
Skip : stylistic/formatting issues
File:Line - Brief descriptionSeverity : Critical/High/Medium/LowProblem : What's wrongEvidence : Why this is real (not already fixed, no existing test, etc.)Fix : Concrete suggestionReferences : OWASP, RFCs, or other standards if applicable If you find nothing significant, say so - don't invent issues.
Do not make changes - just report findings. I'll decide what to address.
Limitations
Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
