0day-scanner

0-Day Vulnerability Scanner Skill

Purpose

Analyze code changes (commits, PRs, files) for potential zero-day security vulnerabilities using LLM-powered analysis. This skill provides conversational access to the 0-Day Scanner Agent with real-time token monitoring and knowledge graph integration.

Stack-aware fallback (when MCP unavailable): if analyze_for_zero_day_vulnerabilities is not reachable, detect the changed files' language(s) and load the matching reference pack from ../Security-automated-claude-skills/.claude/skills/security-reviewer/languages/{python,javascript-typescript,go,java,rust,ruby,dotnet}.md to drive a diff-only review using the assistant's built-in tools. Apply the 8-point check from ../Security-automated-claude-skills/.claude/skills/security-reviewer/SKILL.md scoped to the diff.

When to Use

• User asks to "scan for vulnerabilities" or "check for security issues"
• User mentions "0-day", "zero-day", or "security analysis"
• User wants to analyze a specific commit, PR, or file for security
• User requests vulnerability assessment during code review

Workflow

1. Parse User Request

Extract:

• Target: Commit SHA, PR number, file path, or branch
• Scope: Single commit (light), multiple commits (standard), or full branch (deep)
• Budget: Max cost willing to spend (default: $0.10 for light mode)
• Options: Link to graph, save to DB, return reasoning

2. Invoke Scanner

Use MCP tool analyze_for_zero_day_vulnerabilities:

{
  "commit_sha": "abc123def456",
  "mode": "light",
  "max_cost_usd": 0.10,
  "link_to_graph": true,
  "save_to_db": true,
  "stream_tokens": true,
  "return_reasoning": true
}

3. Monitor Progress

• Stream token usage updates to user
• Report estimated cost and time remaining
• Show findings as they're discovered

4. Present Results

If vulnerabilities found:

• Summarize each vulnerability with severity and type
• Show affected code and proof of concept
• Display knowledge graph context (affected symbols, blast radius)
• Provide remediation suggestions