ByamB4

ByamB4/find-cve-agent

Skill Claude CodeCodex

Detect path traversal and Zip Slip vulnerabilities where user-controlled path components can escape intended directories.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Detect prototype pollution via object merge/clone/assign operations where proto or constructor.prototype keys can modify Object.prototype.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Detect stack overflow and infinite recursion DoS in recursive parsers, tree walkers, and serializers that lack depth limits.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Detect Regular Expression Denial of Service (ReDoS) where crafted input causes catastrophic backtracking in regex patterns applied to user-controlled strings.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Generate polished, human-sounding vulnerability disclosure reports for GHSA, HackerOne, and email. Auto-selects channel, calculates CVSS, and adapts tone.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Detect VM/sandbox escape vulnerabilities in packages using node:vm, simpleeval, or custom sandboxes that can be bypassed to achieve code execution.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Detect SQL injection where user input reaches SQL query construction through string concatenation, template literals, or ORM raw query methods.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Detect Server-Side Request Forgery where user-controlled URLs can reach internal services, cloud metadata endpoints, or bypass network boundaries.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Detect Server-Side Template Injection where user input is passed as the template string itself rather than as template variables, enabling code execution.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Target discovery methodology for finding high-quality npm/PyPI/GitHub packages to audit for vulnerabilities, with evaluation criteria and search strategies.

ByamB4/find-cve-agent

Skill Claude CodeCodex

Detect XML External Entity injection where XML parsers process untrusted input with external entity loading enabled, allowing file read or SSRF.