find-bugs

Use it when:: You want the changes on your current branch checked for bugs and security holes before you merge.
It does:: Reads the full diff against the default branch, maps each file's inputs, queries, auth checks and external calls, then runs an 11-item security checklist on every file.
You get:: Findings ranked security first, each with file and line, severity, problem, evidence and a concrete fix, or a plain statement that nothing significant turned up.
Doesn't:: Edit code or report style and formatting issues; you decide what to fix.
Unlike Sentry's security-review:: That one researches the whole codebase for exploitable vulnerabilities only; this one covers just the branch diff, bugs and quality included.
Needs:: git and the GitHub CLI, which it uses to find the default branch.

TL;DR

A five-phase branch review from Sentry. It gets the whole diff from the default branch to HEAD, reading changed files one by one if the output is truncated, and lists every modified file. It then maps each file's attack surface: user inputs, database queries, authentication and authorization checks, session and state operations, external calls and cryptography. Every file goes through the same checklist: injection, XSS, authentication, authorization and IDOR, CSRF, race conditions, sessions, cryptography, information disclosure, denial of service and business logic. Each candidate issue is then verified: is it handled elsewhere in the change, does a test cover it, does the surrounding code confirm it. Before reporting, the agent must list every file it read in full, the result of each checklist item and anything it couldn't verify. Findings put security vulnerabilities before bugs before code quality, skip style, cite OWASP or RFCs where relevant, and it is told not to invent issues when there are none.

Summarizes the skill at e94f222.

npx skills add https://github.com/getsentry/skills --skill find-bugs

skills.sh page Source on GitHub All skills from getsentry/skills

Total Downloads: 7,300 on skills.sh, Nov 9, 2026
Repo stars: 1,135 getsentry/skills
First seen: Jan 20, 2026 on skills.sh

Weekly Downloads

173

+40% over the 8 weeks to Nov 9

Weekly values

Week to	Installs
Sep 21	124
Sep 28	334
Oct 5	538
Oct 12	132
Oct 19	201
Oct 26	156
Nov 2	182
Nov 9	173

Category	category:debugging category:security category:software-engineering Find root causes, review code and test what you built. Compliance, guardrails, skill vetting and browser fingerprinting. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills.
Type	type:workflow A multi-step process the agent follows: interview, debug, run a TDD loop, review.
Effect	effect:none Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code.
Needs	needs:cli A specific command-line tool or desktop app must be installed, such as gh, agent-browser, LibreOffice, Obsidian or a vendor CLI.
Publisher	by:official A verified publisher on skills.sh, or the company or maintainer behind the product the skill operates.
Topics	code-review security
Stack	stack:git stack:github

SKILL.md

From getsentry/skills at e94f222. Checked daily, last changed Nov 6, 2026.

Frontmatter

name: find-bugs
description: Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

Find Bugs

Review changes on this branch for bugs, security vulnerabilities, and code quality issues.

Phase 1: Complete Input Gathering

Get the FULL diff: git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD
If output is truncated, read each changed file individually until you have seen every changed line
List all files modified in this branch before proceeding

Phase 2: Attack Surface Mapping

For each changed file, identify and list:

All user inputs (request params, headers, body, URL components)
All database queries
All authentication/authorization checks
All session/state operations
All external calls
All cryptographic operations

Phase 3: Security Checklist (check EVERY item for EVERY file)

[ ] Injection: SQL, command, template, header injection
[ ] XSS: All outputs in templates properly escaped?
[ ] Authentication: Auth checks on all protected operations?
[ ] Authorization/IDOR: Access control verified, not just auth?
[ ] CSRF: State-changing operations protected?
[ ] Race conditions: TOCTOU in any read-then-write patterns?
[ ] Session: Fixation, expiration, secure flags?
[ ] Cryptography: Secure random, proper algorithms, no secrets in logs?
[ ] Information disclosure: Error messages, logs, timing attacks?
[ ] DoS: Unbounded operations, missing rate limits, resource exhaustion?
[ ] Business logic: Edge cases, state machine violations, numeric overflow?

Phase 4: Verification

For each potential issue:

Check if it's already handled elsewhere in the changed code
Search for existing tests covering the scenario
Read surrounding context to verify the issue is real

Phase 5: Pre-Conclusion Audit

Before finalizing, you MUST:

List every file you reviewed and confirm you read it completely
List every checklist item and note whether you found issues or confirmed it's clean
List any areas you could NOT fully verify and why
Only then provide your final findings

Output Format

Prioritize: security vulnerabilities > bugs > code quality

Skip: stylistic/formatting issues

For each issue:

File:Line - Brief description
Severity: Critical/High/Medium/Low
Problem: What's wrong
Evidence: Why this is real (not already fixed, no existing test, etc.)
Fix: Concrete suggestion
References: OWASP, RFCs, or other standards if applicable

If you find nothing significant, say so - don't invent issues.

Do not make changes - just report findings. I'll decide what to address.