# Aeon Vuln Scanner

Audit trending repos for real exploitable vulnerabilities and disclose responsibly, ...

- Repository: https://github.com/BankrBot/skills (1208 stars)
- Category: Security
- License: see repository
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BankrBot/skills --skill aeon-vuln-scanner -g -a claude-code -y`
Codex: `npx skills add BankrBot/skills --skill aeon-vuln-scanner -g -a codex -y`
Cursor: `npx skills add BankrBot/skills --skill aeon-vuln-scanner -g -a cursor -y`
Gemini CLI: `npx skills add BankrBot/skills --skill aeon-vuln-scanner -g -a gemini-cli -y`

## Description

Audit trending repos for real exploitable vulnerabilities and disclose responsibly, Private Vulnerability Reporting for code flaws and verified secrets, public PRs only for already-disclosed dependency CVEs. Semgrep + TruffleHog + osv-scanner + Slither with reachability triage. Skips targets that have no safe disclosure channel. Triggers: "vuln scan owner/repo", "audit this repo", "responsible-disclosure scan", "check for secret leaks", "scan dependencies for CVEs".

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# aeon-vuln-scanner

A scanner that dumps zero-days into public PRs isn't a helper, it's a publisher. This skill triages every finding by reading the code and routes to the right disclosure channel.

## Inputs

| Param | Description |
|---|---|
| `var` | Optional `owner/repo`. If empty, auto-picks from chained github-trending output or fresh trending API. |

## Target selection

- Language: JS/TS, Python, Go, Rust, or Solidity.
- ≥ 50 stars, not a fork, active in last 6 months.
- Handles untrusted input (auth, crypto, network, file I/O, templating).
- Skip: intentionally vulnerable teaching repos (juice-shop, webgoat, *-ctf).
- Skip if no PVR enabled AND no `SECURITY.md`, no safe channel.
- Skip if scanned in last 30 days (dedup via `vuln-scanned.json`).

## Scanners

```bash
# Static analysis
semgrep --config=p/security-audit --config=p/owasp-top-ten --config=p/secrets \
  --severity=ERROR --severity=WARNING --json --timeout=300 \
  --exclude=test --exclude=examples --exclude=node_modules .

# Verified secrets (filesystem + git history)
trufflehog filesystem . --only-verified --json
trufflehog git file://. --only-verified --json

# Dependency CVEs across npm/pip/go/cargo/etc
osv-scanner --format=json --recursive .

# Solidity (if .sol files present)
slither . --json out.json --exclude-informational --exclude-low
```

All-scanners-failed reports **error**, never **clean**.

## Triage (per candidate)

1. Open the file at the reported line. Read 30-50 lines of context.
2. Write one sentence: *what attacker controls, what they achieve*. Can't? Discard.
3. Check the call path, reachable from external input in production code?
4. Drop if in tests, fixtures, examples, behind a feature flag, or requires attacker privs ≥ what's gained.

## Disclosure routing

The rest: https://github.com/BankrBot/skills/blob/HEAD/aeon-vuln-scanner/SKILL.md