Skills

Skill 13 of 27

Find Bugs

Find bugs, security vulnerabilities, and code quality issues in local branch changes.

2 minutes · 339 words · 6 sections

Install

$ npx skills add getsentry/skills --skill find-bugs

$ npx skills add getsentry/skills

» /plugin marketplace add getsentry/skills

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Review changes on this branch for bugs, security vulnerabilities, and code quality issues.

Phase 1: Complete Input Gathering

Get the FULL diff: git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD
If output is truncated, read each changed file individually until you have seen every changed line
List all files modified in this branch before proceeding

Phase 2: Attack Surface Mapping

For each changed file, identify and list:

All user inputs (request params, headers, body, URL components)
All database queries
All authentication/authorization checks
All session/state operations
All external calls
All cryptographic operations

Phase 3: Security Checklist (check EVERY item for EVERY file)

Not done: Injection: SQL, command, template, header injection
Not done: XSS: All outputs in templates properly escaped?
Not done: Authentication: Auth checks on all protected operations?
Not done: Authorization/IDOR: Access control verified, not just auth?
Not done: CSRF: State-changing operations protected?
Not done: Race conditions: TOCTOU in any read-then-write patterns?
Not done: Session: Fixation, expiration, secure flags?
Not done: Cryptography: Secure random, proper algorithms, no secrets in logs?
Not done: Information disclosure: Error messages, logs, timing attacks?
Not done: DoS: Unbounded operations, missing rate limits, resource exhaustion?
Not done: Business logic: Edge cases, state machine violations, numeric overflow?

Phase 4: Verification

For each potential issue:

Check if it’s already handled elsewhere in the changed code
Search for existing tests covering the scenario
Read surrounding context to verify the issue is real

Phase 5: Pre-Conclusion Audit

Before finalizing, you MUST:

List every file you reviewed and confirm you read it completely
List every checklist item and note whether you found issues or confirmed it’s clean
List any areas you could NOT fully verify and why
Only then provide your final findings

Output Format

Prioritize: security vulnerabilities > bugs > code quality

Skip: stylistic/formatting issues

For each issue:

File:Line - Brief description
Severity: Critical/High/Medium/Low
Problem: What’s wrong
Evidence: Why this is real (not already fixed, no existing test, etc.)
Fix: Concrete suggestion
References: OWASP, RFCs, or other standards if applicable

If you find nothing significant, say so - don’t invent issues.

Do not make changes - just report findings. I’ll decide what to address.

About this skill

Trigger

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Colophon for this issue

Colophon

How this issue was made

Source

github.com/getsentry/skills, branch main, last pushed 21 September 2026.

Licence

Apache-2.0 — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

27 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. One layout observed: skills/*/SKILL.md.

Issue colours

Resolved from a deterministic hash of the owner name. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Removed “Find Bugs”, a leading h1 that duplicated the skill title.

Spec compliance

Every skill satisfies the Agent Skills specification’s frontmatter rules.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .claude-plugin/marketplace.json by Sentry, declaring 1 plugin. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /getsentry/skills.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Phase 3: Security Checklist (check EVERY item for EVERY file)

Injection: SQL, command, template, header injection

XSS: All outputs in templates properly escaped?

Authentication: Auth checks on all protected operations?

Authorization/IDOR: Access control verified, not just auth?

CSRF: State-changing operations protected?

Race conditions: TOCTOU in any read-then-write patterns?

Session: Fixation, expiration, secure flags?

Cryptography: Secure random, proper algorithms, no secrets in logs?

Information disclosure: Error messages, logs, timing attacks?

DoS: Unbounded operations, missing rate limits, resource exhaustion?

Business logic: Edge cases, state machine violations, numeric overflow?

Output Format

Prioritize: security vulnerabilities > bugs > code quality

Skip: stylistic/formatting issues

For each issue:

File:Line - Brief description

Severity: Critical/High/Medium/Low

Problem: What’s wrong

Evidence: Why this is real (not already fixed, no existing test, etc.)

Fix: Concrete suggestion

References: OWASP, RFCs, or other standards if applicable

If you find nothing significant, say so - don’t invent issues.

Do not make changes - just report findings. I’ll decide what to address.