Vuln Scan
Static source-code vulnerability scan.
Install
npx skills add anthropics/defending-code-reference-harness --skill vuln-scan -g -a claude-code -y- Repository
- anthropics/defending-code-reference-harness7.7k
- Category
- Security
- Updated
- 3mo ago
- License
- See repository
- Context cost
- Mediumabout 2,822 tokens
- Runs scripts
- No, instructions only
What it does
Static source-code vulnerability scan. Reads a target directory (and THREAT_MODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only, no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in <dir>", or as the step between /threat-model and /triage.
/vuln-scan
Static vulnerability review of a source tree. Produces VULN-FINDINGS.json
(+ a human-readable .md) that /triage ingests directly.
This skill does not execute code. It reads source and reasons about it.
For execution-verified findings (ASAN crashes, reproducing PoCs), point the
user at vuln-pipeline run <target>, see README Step 2.
Tool fallbacks. Prefer the dedicated Glob and Grep tools. Some sessions
do not provision them, allowed-tools is a permission filter, not a loader,
so listing them here does not make them appear. When Glob/Grep are
unavailable, fall back to the read-only Bash commands whitelisted above:
rg --files <scope> / ls -R for enumeration, rg -n / grep -rn for
search, wc / head / file for sniffing. These are the ONLY permitted
Bash commands; do not write helper scripts or pipe target content into a
shell interpreter.
Arguments
<target-dir>(required), directory to scan. Relative or absolute.--focus <area>, scan only this focus area (repeatable). Skips recon.--single, no subagent fan-out; one sequential pass. Use on tiny targets or when debugging the prompt.--extra <file>, append the contents of<file>to the review brief (after the category list). Use to add org-specific vulnerability classes, compliance checks, or stack-specific patterns. Plain text; same shape as the category blocks below.--no-score, skip the Step 3b confidence pass (saves a round of subagents). Findings keep the scanner's self-reported confidence only.
