vuln-scan Skill
Static source-code vulnerability scan. Reads a target directory (and THREATMODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when Published by anthropics in defending-code-reference-harness.
Decision snapshot
Is this a fit?
Security review, Writing, Research, Includes SKILL.md
Compatibility not yet detected.
Can write or update data, Write actions, Filesystem access, Shell access
Copy skill directory
1 month ago · NOASSERTION license
Confirm write permissions and scope before use. Access note: Local files. Access note: Shell access.
What is vuln-scan Skill?
Static source-code vulnerability scan. Reads a target directory (and THREATMODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when Published by anthropics in defending-code-reference-harness. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement. See how SkillIndex evaluates profiles.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Writing
- Research
- Security review use cases
- Writing use cases
Declared skill metadata
- Source file: .claude/skills/vuln-scan/SKILL.md
Allowed tools declared by source
These fields retain source and confidence evidence from the indexed SKILL.md.
Compatibility and setup
- Install or run with Copy skill directory
- Local files
- Shell access
Requirements and access
Security and permissions
Review permissions before connecting any MCP server to an agent. Pay special attention to whether it can read local files, write data, call external services, or perform destructive actions.
When to use vuln-scan Skill
- Use it for security review.
- Use it for writing.
- Use it for research.
Built with
Editorial notes
Source
- Creator: anthropics
- Repository: anthropics/defending-code-reference-harness
- Skill file: .claude/skills/vuln-scan/SKILL.md
What it does
Static source-code vulnerability scan. Reads a target directory (and THREATMODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when
Skill instructions
/vuln-scan Static vulnerability review of a source tree. Produces VULN-FINDINGS.json (+ a human-readable .md) that /triage ingests directly. This skill does not execute code. It reads source and reasons about it. For execution-verified findings (ASAN crashes, reproducing PoCs), point the user at vuln-pipeline run <target — see README Step 2. Tool fallbacks. Prefer the dedicated Glob and Grep tools. Some sessions do not provision them — allowed-tools is a permission filter, not a loader, so listing them here does not make them appear. When Glob/Grep are unavailable, fall back to the read-only Bash commands whitelisted above: rg --files <scope / ls -R for enumeration, rg -n / grep -rn for search, wc / head / file for sniffing. These are the ONLY permitted Bash commands; do not write helper scripts or pipe target content into a shell interpreter. Arguments - <target-dir (required) — directory to scan. Relative or absolute. - --focus <area — scan only this focus area (repeatable). Skips re
Verified compatibility and discovery
Frequently asked questions
What is vuln-scan?
vuln-scan is a open-source AI agent skill with Copy skill directory. Static source-code vulnerability scan. Reads a target directory (and THREATMODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume.
Who is vuln-scan best for?
vuln-scan is best for reusing agent instructions, scripts, and references, security review workflows, writing workflows, research workflows.
How do I install vuln-scan?
Install or run vuln-scan using Copy skill directory. Check vuln-scan for the latest setup command.
Is vuln-scan actively maintained?
vuln-scan may need a closer maintenance check before production use.
Project health auto-fetched from the source repository.
Maintain this resource?
Review this source-backed profile, send a correction with evidence, or link to it from your documentation. Claims verify your relationship to the project; profile facts still require source evidence and editorial review.
