vulnerability-discovery

name	vulnerability-discovery
description	Use when you need a repeatable workflow to discover and document likely application security vulnerabilities with evidence and standard mapping.
argument-hint	Provide the target paths and max findings, for example: app plus static/js, top 5 findings
user-invocable	true

Vulnerability Discovery Skill

When to use

Use for initial discovery and triage preparation.

Inputs

• Target scope (files or folders)
• Maximum findings to return
• Optional focus areas (prompt injection, XSS, authz, config)

Procedure

1. Scan for high-risk patterns in backend endpoints, request handling, and state mutation.
2. Scan frontend rendering paths for unsafe HTML handling and client-side trust assumptions.
3. Scan configuration and error paths for hardening gaps.
4. Build findings with severity, evidence, and control mapping.
5. Mark uncertain items as "Needs verification".

Required output fields

• id
• title
• severity
• evidence
• control_ids
• rationale
• status (confirmed or needs_verification)

Control mapping source

Use docs/appsec-demo/appsec-baseline-standard.md for control IDs.