Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Find Bugs · davila7 | DecimalAI

davila7/find-bugs

SkillScore84Maintained

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

Code Reviewby davila7

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/davila7-find-bugs/SKILL.md

decimalai skills pull davila7-find-bugs --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/davila7-find-bugs/SKILL.md https://app.decimal.ai/s/davila7-find-bugs/SKILL.md

Raw file: /s/davila7-find-bugs/SKILL.md ↗ · machine-readable summary at /s/davila7-find-bugs.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

25 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 46d ago

Yes — +24% lift+3% tokens0% turns84% of whole cases pass with skill (21/25)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	-39%	0%
case-04	✗→✓	▲ Improved	-34%	0%
case-05	✗→✓	▲ Improved	3%	0%
case-08	✗→✓	▲ Improved	-35%	0%
case-16	✗→✓	▲ Improved	10%	0%

Showing 5 of 25 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

davila7 / claude-code-templates

cli-tool/components/skills/sentry/find-bugs/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

Find Bugs

Review changes on this branch for bugs, security vulnerabilities, and code quality issues.

Phase 1: Complete Input Gathering

Get the FULL diff: git diff master...HEAD
If output is truncated, read each changed file individually until you have seen every changed line
List all files modified in this branch before proceeding

Phase 2: Attack Surface Mapping

For each changed file, identify and list:

All user inputs (request params, headers, body, URL components)
All database queries
All authentication/authorization checks
All session/state operations
All external calls
All cryptographic operations

Phase 3: Security Checklist (check EVERY item for EVERY file)

] Injection: SQL, command, template, header injection
] XSS: All outputs in templates properly escaped?
] Authentication: Auth checks on all protected operations?
] Authorization/IDOR: Access control verified, not just auth?
] CSRF: State-changing operations protected?
] Race conditions: TOCTOU in any read-then-write patterns?
] Session: Fixation, expiration, secure flags?
] Cryptography: Secure random, proper algorithms, no secrets in logs?
] Information disclosure: Error messages, logs, timing attacks?
] DoS: Unbounded operations, missing rate limits, resource exhaustion?
] Business logic: Edge cases, state machine violations, numeric overflow?

Phase 4: Verification

For each potential issue:

Check if it's already handled elsewhere in the changed code
Search for existing tests covering the scenario
Read surrounding context to verify the issue is real

Phase 5: Pre-Conclusion Audit

Before finalizing, you MUST:

List every file you reviewed and confirm you read it completely
List every checklist item and note whether you found issues or confirmed it's clean
List any areas you could NOT fully verify and why
Only then provide your final findings

Output Format

Prioritize: security vulnerabilities > bugs > code quality

Skip: stylistic/formatting issues

For each issue:

File:Line - Brief description
Severity: Critical/High/Medium/Low
Problem: What's wrong
Evidence: Why this is real (not already fixed, no existing test, etc.)
Fix: Concrete suggestion
References: OWASP, RFCs, or other standards if applicable

If you find nothing significant, say so - don't invent issues.

Do not make changes - just report findings. I'll decide what to address.

Illustrative Want to see what davila7/find-bugs would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/13/2026, 11:55 UTC · 25 cases

Lift

+24%

84% vs 60%

Agent turns

1.0 vs 1.0

Tokens

+3%

1,883.56 vs 1,824.88

fail → pass · 6pass → pass · 15fail → fail · 4

Per-case results (25)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-17 What specific security checklist criteria must be validated when reviewing cryptographic operations in user authentication code?	pass→pass	16,468	11,416	-31%	1	1	0%	2,698	2,415	-10%	0	0	—
case-01 I've finished working on a new feature branch and want a thorough security and bug review of my changes compared to master. Please inspect every modified file in the diff to evaluate potential security risks, state handling flaws, or application bugs. Format any identified findings with the specific file and line number, severity ranking, issue breakdown, evidence that it isn't covered by existing code or tests, a recommended fix, and applicable standards references. Please skip pure code style issues and refrain from making direct edits.	fail→fail	14,039	9,617	-31%	1	1	0%	1,594	1,590	-0%	0	0	—
case-02 Please perform a complete code review on my feature branch before I open a pull request. Go through the branch diff completely, inventorying changed files and attack entry points, and run a systematic check across security flaw categories like injection, broken access control, and race conditions. Present your results prioritized by severity down to code quality, detailing for each issue its location, severity level, root cause, proof of impact, proposed resolution, and reference links. If no critical issues exist, let me know clearly rather than inventing minor alerts.	fail→fail	8,741	10,510	+20%	1	1	0%	1,044	1,869	+79%	0	0	—
case-22 When reviewing a branch with multiple critical vulnerabilities, should the reviewer directly edit the source files to apply fixes?	pass→pass	10,685	9,183	-14%	1	1	0%	1,635	1,873	+15%	0	0	—
case-03 I want to start a review of my branch diff against the master branch to identify security flaws. What specific command should be executed first to pull the complete branch diff?	fail→pass	7,749	2,075	-73%	1	1	0%	1,229	746	-39%	0	0	—
case-04 When running a git diff for a review, the output was truncated due to buffer limits. How should the remaining changed files be gathered before proceeding with review?	fail→pass	10,955	4,050	-63%	1	1	0%	1,867	1,236	-34%	0	0	—
case-05 Before delivering the final list of bug findings for a pull request review, what audit step must be completed regarding checklist items and reviewed files?	fail→pass	5,880	2,502	-57%	1	1	0%	900	929	+3%	0	0	—
case-06 During a code review, if certain cryptographic implementations or external API calls cannot be fully verified due to missing context, how should those unverified areas be handled in the review audit?	pass→pass	13,263	12,264	-8%	1	1	0%	1,972	2,304	+17%	0	0	—
case-07 I have compiled several findings during code review, including a style formatting inconsistency, a missing database index performance issue, and a remote code execution vulnerability. In what priority order should these issue categories be presented?	pass→pass	26,294	3,618	-86%	1	1	0%	1,490	1,163	-22%	0	0	—
case-08 During a branch review, I noticed several PEP8 indentation and naming convention inconsistencies alongside a potential race condition. Should the stylistic formatting issues be included in the findings report?	fail→pass	9,814	3,044	-69%	1	1	0%	1,551	1,013	-35%	0	0	—
case-09 What specific metadata fields must be included for each identified security issue report line to ensure clear evidence and actionability?	pass→pass	14,208	4,081	-71%	1	1	0%	2,587	1,234	-52%	0	0	—
case-10 When auditing stateful database operations that check a balance before deducting funds, what specific race condition pattern must be evaluated during the security checklist phase?	pass→pass	9,995	8,747	-12%	1	1	0%	1,601	2,095	+31%	0	0	—
case-11 During the initial attack surface mapping phase of a web application diff review, what specific operational components must be identified across changed files besides user inputs and database queries?	pass→pass	17,945	3,968	-78%	1	1	0%	2,677	1,194	-55%	0	0	—
case-12 Which specific four-tier severity classification scale should be assigned to findings discovered during the review?	pass→pass	8,473	3,917	-54%	1	1	0%	1,420	1,074	-24%	0	0	—
case-13 I performed a security and quality review on a small documentation update diff and found no security flaws or logic bugs. How should this clean result be reported?	pass→pass	9,230	4,737	-49%	1	1	0%	1,375	1,341	-2%	0	0	—
case-14 When a potential cross-site scripting vulnerability is flagged in a modified template during review, what verification step must be performed before marking it as a confirmed finding?	fail→fail	9,058	7,539	-17%	1	1	0%	1,513	1,721	+14%	0	0	—
case-15 What specific resource exhaustion and boundary checks must be performed under the Denial of Service (DoS) security checklist item?	pass→pass	16,348	15,559	-5%	1	1	0%	2,717	3,096	+14%	0	0	—
case-16 When reviewing financial calculation changes in a checkout handler, what specific checklist criteria under business logic should be evaluated?	fail→pass	15,666	13,212	-16%	1	1	0%	2,317	2,541	+10%	0	0	—
case-18 When auditing error handling blocks in an API controller, what specific vulnerabilities under the information disclosure checklist item must be audited?	fail→fail	15,156	11,228	-26%	1	1	0%	2,393	2,428	+1%	0	0	—
case-19 In web application templates modified on a feature branch, what specific check must be performed regarding rendered variables under the XSS checklist item?	pass→pass	8,458	3,678	-57%	1	1	0%	1,245	1,130	-9%	0	0	—
case-20 When state management and session code is modified on a feature branch, which specific checklist criteria must be verified for session protection?	pass→pass	13,599	13,014	-4%	1	1	0%	2,092	2,654	+27%	0	0	—
case-21 What is the critical distinction required when checking authorization under the checklist phase compared to simple authentication checks?	pass→pass	9,694	6,716	-31%	1	1	0%	1,501	1,417	-6%	0	0	—
case-23 Here is a Python function vulnerable to SQL injection in my API handler. Please write the refactored Python code that replaces string concatenation with parameterized queries and updates the file directly.	fail→pass	4,526	10,898	+141%	1	1	0%	713	2,570	+260%	0	0	—
case-24 I need to write unit tests for my Python authentication module using pytest to verify that password hash generation and login rate-limiting function as expected. Please generate the test suite.	pass→pass	18,767	19,365	+3%	1	1	0%	3,616	4,523	+25%	0	0	—
case-25 I am trying to merge my feature branch into master, but git reports merge conflicts in three files. Walk me through the step-by-step git CLI commands to rebase master onto my branch and resolve conflicts.	pass→pass	10,858	12,466	+15%	1	1	0%	1,875	2,933	+56%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of +24 percentage points is the difference between those two pass rates over the 25 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 60%
Pass rate with the skill: 84%
Cases attempted: 25
Cases counted toward lift: 25
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/13/2026, 11:55 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

I want to start a review of my branch diff against the master branch to identify security flaws. What specific command should be executed first to pull the complete branch diff?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run84

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns0% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 46 days ago

Other measured skills in the registry, with their headline benchmark lift.