Use this when the user wants to find security vulnerabilities in a codebase, perform a security audit, scan for CVEs, detect secrets, review React/Next.js, Go, Java/Kotlin JVM, PHP, Ruby, .NET, or Rust web services, audit architecture/application/infrastructure flaws, review auth/API/crypto/business logic, check IaC/cloud/runtime configs, or generate a vulnerability report. Performs taint-flow, control-flow, architecture, and exploitability analysis across Python, JS/TS, Java/Kotlin, Go, PHP, Ruby, C/C++, C#, Rust, and infrastructure.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Use this when the user wants to find security vulnerabilities in a codebase, perform a security audit, scan for CVEs, detect secrets, review React/Next.js, Go, Java/Kotlin JVM, PHP, Ruby, .NET, or Rust web services, audit architecture/application/infrastructure flaws, review auth/API/crypto/business logic, check IaC/cloud/runtime configs, or generate a vulnerability report. Performs taint-flow, control-flow, architecture, and exploitability analysis across Python, JS/TS, Java/Kotlin, Go, PHP, Ruby, C/C++, C#, Rust, and infrastructure.
Code-VulnScan — Deep Codebase Vulnerability Scanner
This skill performs comprehensive, flow-aware security analysis on any codebase. It combines taint tracking, control-flow analysis, business logic review, API security auditing, secret detection, configuration review, and dependency auditing to find real, exploitable vulnerabilities — not keyword matches.
Use the IDE's own tools for reading, searching, and reasoning about code.
Use local Python scripts for deterministic file enumeration, AST-based analysis, secret entropy scanning, dependency checking, state tracking, and report generation.
Do not call external LLM-provider APIs as part of this skill.
Every confirmed finding requires a verified evidence chain. Candidates without verification are never reported.
Commit/diff mode: Scans only the files and code regions changed in a commit or between two refs. Faster than a full scan — designed for CI/CD pipelines and code review. Findings are tagged introduced_in_diff: true (new vulnerability in the changed code) or introduced_in_diff: false (pre-existing vulnerability in code called by the change). Use vulnscan commit HEAD to scan the most recent commit, vulnscan diff main HEAD to scan a feature branch, or vulnscan pr 42 to scan a GitHub PR diff.
Defaults: report every validated severity and auto-detect language from file extensions. Use --min-severity when the user explicitly requests a threshold.
Core architecture
sub-skills/ — cognitive instructions for each analysis phase (29 specialized reviewers)
sub-skills/go-security-reviewer.md — Go net/http, Gin, Echo, Fiber, Chi, Gorilla, gRPC, workers, request binding, or Go server hardening.
sub-skills/java-security-reviewer.md — Java/Kotlin JVM services using Spring, Jakarta EE/Servlet/JAX-RS, Struts, JSF, Hibernate/JPA, Micronaut, Quarkus, JVM messaging, or async workers. For Android, also load mobile-security-reviewer.md.
sub-skills/php-security-reviewer.md — Laravel, Symfony, WordPress, Drupal, Yii, CodeIgniter, custom PHP front controllers, Composer applications, or PHP workers.
sub-skills/ruby-security-reviewer.md — Rails, Sinatra/Rack, Hanami, Active Record/Sequel, Ruby templates, channels, or background jobs.
sub-skills/dotnet-security-reviewer.md — ASP.NET Core/MVC/Web API, minimal APIs, Blazor, EF Core, Dapper, SignalR, or .NET workers.
sub-skills/rust-security-reviewer.md — Actix-web, Axum, Warp, Rocket, SQLx/Diesel, Tokio services, or Rust workers processing untrusted data.
These reviewers do not replace taint analysis. Use them to expand the entry-point list, identify non-obvious sources/sinks, and add manual review targets before Phase 1.
Phase 1: Taint and injection analysis (parallel)
Read sub-skills/taint-analyzer.md. Run per-file taint analysis:
Use script output as a starting map. Read every flagged file directly and trace each candidate path step by step. Verify every taint path — source to sink — reading actual code at each hop. Interprocedural traces must follow function calls across file boundaries.
If the system has multiple services, tenants, workers, plugins, or cloud resources, also read sub-skills/architecture-security-reviewer.md and verify authorization, tenant scoping, and trust-boundary enforcement across the full request/job path.
Phase 5: Authentication and authorization review
Read sub-skills/auth-reviewer.md. Examine:
Authentication mechanisms and bypass paths
Session management, fixation, expiry
JWT/token construction and validation
Authorization middleware — is it applied consistently?
Privilege escalation and horizontal access control
Phase 6: Cryptography and secrets review
Read sub-skills/crypto-reviewer.md and sub-skills/secret-detector.md.
Run entropy-based secret scanning:
python3 scripts/secrets.py --path <target>
Analyze:
Algorithm selection (MD5/SHA1 for security, ECB mode, DES/RC4)
Key sizes and generation
Hardcoded credentials, API keys, tokens
IV/nonce reuse, predictable keys
Certificate validation bypasses
Phase 7: Configuration and infrastructure security
Read sub-skills/config-security-reviewer.md, sub-skills/iac-security-reviewer.md, and sub-skills/infrastructure-security-reviewer.md.
Read sub-skills/memory-safety-analyzer.md when the codebase includes C, C++, or unsafe Rust.
Covers: buffer overflows, use-after-free, format string vulnerabilities, integer overflows in allocation sizes, null pointer dereferences.
Phase 8A: Framework-specific review
When React/Next.js/TSX is present, read sub-skills/react-security-reviewer.md and verify client-side DOM XSS, open redirects, browser token storage, postMessage origin checks, hydration data leaks, and client-only authorization.
When Go is present, read sub-skills/go-security-reviewer.md and verify request body binding, SQL construction, command execution, SSRF, file access, template use, HTTP server timeouts, CORS, body limits, and concurrency races.
When a Java/JVM server stack is present, read sub-skills/java-security-reviewer.md and verify effective framework authorization, request/entity binding, SpEL/OGNL/EL, ORM query construction, deserialization/XML, outbound URL handling, archive/path safety, TLS/crypto, Actuator/admin exposure, logging, and async tenant/security-context propagation.
When PHP is present, read sub-skills/php-security-reviewer.md and verify route/middleware/capability authorization, request/model binding, raw ORM/SQL, template escape bypasses, wrappers and outbound URLs, redirects, uploads/archives, deserialization, debug surfaces, and job tenant context.
When Ruby is present, read sub-skills/ruby-security-reviewer.md and verify callbacks/policies, object and tenant authorization, strong parameters, raw ORM fragments, template escape bypasses, SSRF/redirect handling, uploads/archives, serialization, session configuration, and job context.
When a .NET web stack is present, read sub-skills/dotnet-security-reviewer.md and verify endpoint authorization, model binding/overposting, EF Core/Dapper/raw SQL, Razor/Blazor output, SSRF, redirects, files/uploads, XML/object deserialization, Data Protection, antiforgery, forwarded headers, and background-service tenant context.
When a Rust web stack is present, read sub-skills/rust-security-reviewer.md and verify extractor authorization, typed request limits, SQLx/Diesel/raw SQL, process execution, reqwest/hyper URL handling, files/uploads, templates/headers/redirects, serde parsing, unsafe/FFI boundaries, and task-local tenant context.
Phase 9: Error handling and information disclosure
Stack traces and exception details leaked to clients
Verbose SQL errors, file path disclosure
Enumeration through differential error messages
Logging of sensitive data (passwords, tokens, PII)
Phase 10: Dependency audit
python3 scripts/dependency.py --path <target>
Read sub-skills/dependency-auditor.md to assess exploitability of flagged packages. Check direct manifests and resolved lock state, including Python/Poetry/Pipenv, npm/Yarn/pnpm, Maven/Gradle catalogs and locks, Go modules and sums, Gemfile/Composer/Cargo locks, and NuGet project/central-package/lock/Paket files.
Phase 11: False positive elimination
Read sub-skills/false-positive-filter.md. Apply three-pass protocol to every candidate:
Pass 1 — Source reachability: is the input genuinely user-controlled?
Pass 2 — Path completeness: does the taint path hold end-to-end?
Pass 3 — Exploitability: can an attacker realistically trigger this?
Only confirmed and likely findings survive to the report.
Phase 12: Classification and scoring
Read sub-skills/vuln-classifier.md. For every surviving finding assign:
Read sub-skills/report-generator.md. The Phase 12 --update-findings command
automatically generates Markdown, HTML, JSON, SARIF, the canonical confirmed-
findings JSON, and <target_path>/Vulnscan_results.md. This is mandatory even
when the completed review has no findings; submit [] to Phase 12 so the valid
empty reports are still produced.
Verify that every finding contains Vulnerability Name, Severity,
Exploitability, CVSS Score, CVSS Vector, OWASP Category, Vulnerability
Description, Impact, Affected Assets, and Remediation Guidelines. It must also
include a stable Finding ID, CWE, confidence, validation status, exact
locations, masked evidence or taint flow, attack prerequisites, and references.
To regenerate the complete artifact set for the latest completed run:
python3 scripts/report.py --format all
Do not mark the review complete unless every artifact was written successfully.
The in-project Markdown file is the primary human-readable deliverable and must
always exist at the end of a full scan.
