Percerno Skillsbeta
← everything it can do · compliance

Find Bugs TEXT

Analyzes the git diff of the current branch against the default branch to identify security vulnerabilities, logic bugs, and code quality issues. It produces a prioritized report of findings with severity levels, evidence, and concrete fix suggestions without modifying the code.

2 uses this weeksource getsentrylicence Apache-2.0
Quality gate: FAIL · better answers · measured 2026-10-23
Blind-judged against the bare model on 2 requests: average lift -9.5 points (specificity, structure, method, fit).
won 0/2, lift -9.5, tokens ×97.48
Security scan: clean · 2026-10-24 · 1 files · ran in sandbox
no network calls, shell tricks, credential access or instruction tampering found in its files.

Try asking

Say it in your own words; the assistant finds this recipe by itself. Examples:

“Gennemgå min nuværende branch for sikkerhedshuller.”
“Kan du finde fejl i ændringerne til betalingsmodulen?”
“Auditér diffen på denne branch for SQL-injektionsrisici.”
“Review my current branch for any security vulnerabilities before I merge it.”
“Can you find bugs in the changes I made to the payment module?”
“Audit the diff on this branch for SQL injection risks.”
Try this skill from Claude, ChatGPT or a chat on your own page. Free plan, no credit card.Get started free

Good for

security-auditcode-reviewbug-huntingvulnerability-scangit-diffstatic-analysisowaspbranch-review

Not for

Do not use this skill for reviewing entire files or repositories that are not part of the current branch's diff. It is not suitable for general code refactoring, style enforcement, or architectural design reviews that do not focus on the specific changes in the current branch. For full-repository scans or dependency vulnerability checks, a different tool is required.

Details

When it is the right choice

Use this skill when a user asks to review the changes on the current branch for potential bugs or security flaws. It is appropriate for pre-merge audits, security checks, or general code quality assessments of recent commits. It is specifically designed for analyzing the delta between the current branch and the main/default branch.

The full recipe the assistant reads

Find Bugs

Review changes on this branch for bugs, security vulnerabilities, and code quality issues.

Phase 1: Complete Input Gathering

  1. Get the FULL diff: git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD
  2. If output is truncated, read each changed file individually until you have seen every changed line
  3. List all files modified in this branch before proceeding

Phase 2: Attack Surface Mapping

For each changed file, identify and list:

  • All user inputs (request params, headers, body, URL components)
  • All database queries
  • All authentication/authorization checks
  • All session/state operations
  • All external calls
  • All cryptographic operations

Phase 3: Security Checklist (check EVERY item for EVERY file)

  • [ ] Injection: SQL, command, template, header injection
  • [ ] XSS: All outputs in templates properly escaped?
  • [ ] Authentication: Auth checks on all protected operations?
  • [ ] Authorization/IDOR: Access control verified, not just auth?
  • [ ] CSRF: State-changing operations protected?
  • [ ] Race conditions: TOCTOU in any read-then-write patterns?
  • [ ] Session: Fixation, expiration, secure flags?
  • [ ] Cryptography: Secure random, proper algorithms, no secrets in logs?
  • [ ] Information disclosure: Error messages, logs, timing attacks?
  • [ ] DoS: Unbounded operations, missing rate limits, resource exhaustion?
  • [ ] Business logic: Edge cases, state machine violations, numeric overflow?

Phase 4: Verification

For each potential issue:

  • Check if it's already handled elsewhere in the changed code
  • Search for existing tests covering the scenario
  • Read surrounding context to verify the issue is real

Phase 5: Pre-Conclusion Audit

Before finalizing, you MUST:

  1. List every file you reviewed and confirm you read it completely
  2. List every checklist item and note whether you found issues or confirmed it's clean
  3. List any areas you could NOT fully verify and why
  4. Only then provide your final findings

Output Format

Prioritize: security vulnerabilities > bugs > code quality

Skip: stylistic/formatting issues

For each issue:

  • File:Line - Brief description
  • Severity: Critical/High/Medium/Low
  • Problem: What's wrong
  • Evidence: Why this is real (not already fixed, no existing test, etc.)
  • Fix: Concrete suggestion
  • References: OWASP, RFCs, or other standards if applicable

If you find nothing significant, say so - don't invent issues.

Do not make changes - just report findings. I'll decide what to address.

Files in this skill (2)
  • LICENSE
  • SKILL.md
Where it comes from

Vendored from getsentry/skills, commit f57ada2d0b64, path skills/find-bugs, licence Apache-2.0. The upstream licence file ships inside the skill.