find-bugs — Claude Code skill: branch audit for bugs and vulns
Walks the diff on your current branch and reports bugs, security holes and code quality problems. Handy before a merge or a push.
npx claude-code-templates@latest --skill sentry/find-bugsWhat find-bugs does
The skill runs a five-phase review. It starts with the full git diff master...HEAD, and if that output gets truncated it reads every changed file one by one until all changed lines are covered. Then it maps the attack surface per file: user input, database queries, auth checks, session and state operations, external calls, crypto.
Next comes a checklist applied to every file — injection, XSS, authentication, IDOR, CSRF, race conditions, secrets leaking into logs or error messages, missing rate limits. Each candidate issue gets verified: is it already handled elsewhere, is there a test covering it. Before writing conclusions the skill has to list the files it read and go through every checklist item.
Findings are ordered by weight: security first, then bugs, then quality. Styling and formatting are skipped. Every entry carries file and line, severity, evidence and a concrete fix. The skill reports only — it never edits your code. One thing to know: the diff is taken against master, so on a repo whose main branch is named differently you will have to adjust the command yourself.
What it helps with
- review a branch diff before merging
- catch SQL injection and XSS in new lines
- confirm protected operations actually check access
- spot race conditions in read-then-write paths
- get findings ranked by severity with a suggested fix
Example prompts for the agent
- review the changes on this branch for bugs and security issues
- run a security review on the diff before I merge
- audit the code on the current branch
How to install find-bugs
1claude-code-templates
npx claude-code-templates@latest --skill sentry/find-bugs2Skills CLI (Vercel)
npx skills add davila7/claude-code-templates --skill find-bugs -a claude-code3Manually: put the files in place
~/.claude/skills/find-bugs/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/find-bugs/
Manually: put the files in place
.agents/skills/find-bugs/SKILL.mdFor all projects use ~/.agents/skills/
Manually: put the files in place
.cursor/skills/find-bugs/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install davila7/claude-code-templates find-bugs2Manually: put the files in place
.github/skills/find-bugs/SKILL.mdPlatform CLI
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/sentry/find-bugsManually: put the files in place
.devin/skills/find-bugs/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about find-bugs
How do I install find-bugs in Claude?
Use the templates CLI: npx claude-code-templates@latest --skill sentry/find-bugs. Alternatively run npx skills add davila7/claude-code-templates --skill find-bugs -a claude-code. The skill file lands at ~/.claude/skills/find-bugs/SKILL.md.
What does find-bugs do?
It collects the diff for the current branch, maps the attack surface across changed files and runs a checklist over injection, XSS, authorization, CSRF, sessions and crypto. You get a report with severity and a suggested fix, and no code is modified.
Does it fix the code it flags?
No. It only reports findings and leaves the decision to you. If nothing significant turns up, it says so instead of padding the report with invented issues.
