Community Скиллы Разработка

Find Bugs

Claude Code
Открыть источник ↗ GitHub ↗
Установка 
npx claude-code-templates@latest --skill sentry/find-bugs

Описание

find-bugs — скилл аудита изменений: поиск багов — ошибки в правках текущей ветки, уязвимости — security review изменений, качество — проблемы кода, которые пропустит компилятор, ревизия ветки — проверка перед merge. Для разработчиков, желающих чистую ветку и не желающих тащить баги в main.

Что умеет:
— находить баги в изменениях ветки;
— выявлять уязвимости в правках;
— оценивать качество кода;
— ревизовать ветку перед слиянием.

Find Bugs

Review changes on this branch for bugs, security vulnerabilities, and code quality issues.

Phase 1: Complete Input Gathering

  • Get the FULL diff: git diff master...HEAD
  • If output is truncated, read each changed file individually until you have seen every changed line
  • List all files modified in this branch before proceeding

Phase 2: Attack Surface Mapping

For each changed file, identify and list:

  • All user inputs (request params, headers, body, URL components)
  • All database queries
  • All authentication/authorization checks
  • All session/state operations
  • All external calls
  • All cryptographic operations

Phase 3: Security Checklist (check EVERY item for EVERY file)

  • [ ] Injection: SQL, command, template, header injection
  • [ ] XSS: All outputs in templates properly escaped?
  • [ ] Authentication: Auth checks on all protected operations?
  • [ ] Authorization/IDOR: Access control verified, not just auth?
  • [ ] CSRF: State-changing operations protected?
  • [ ] Race conditions: TOCTOU in any read-then-write patterns?
  • [ ] Session: Fixation, expiration, secure flags?
  • [ ] Cryptography: Secure random, proper algorithms, no secrets in logs?
  • [ ] Information disclosure: Error messages, logs, timing attacks?
  • [ ] DoS: Unbounded operations, missing rate limits, resource exhaustion?
  • [ ] Business logic: Edge cases, state machine violations, numeric overflow?

Phase 4: Verification

For each potential issue:

  • Check if it’s already handled elsewhere in the changed code
  • Search for existing tests covering the scenario
  • Read surrounding context to verify the issue is real

Phase 5: Pre-Conclusion Audit

Before finalizing, you MUST:

  • List every file you reviewed and confirm you read it completely
  • List every checklist item and note whether you found issues or confirmed it’s clean
  • List any areas you could NOT fully verify and why
  • Only then provide your final findings

Output Format

Prioritize: security vulnerabilities > bugs > code quality

Skip: stylistic/formatting issues

For each issue:

  • File:Line – Brief description
  • Severity: Critical/High/Medium/Low
  • Problem: What’s wrong
  • Evidence: Why this is real (not already fixed, no existing test, etc.)
  • Fix: Concrete suggestion
  • References: OWASP, RFCs, or other standards if applicable

If you find nothing significant, say so – don’t invent issues.

Do not make changes – just report findings. I’ll decide what to address.