vulnhunter

# VulnHunter - Security Vulnerability Detection & Analysis A comprehensive security audit skill for identifying dangerous APIs, footgun patterns, error-prone configurations, and hunting for vulnerability variants across codebases. Inspired by Trail of Bits' sharp-edges and variant-analysis methodologies. ## Overview VulnHunter combines two powerful security analysis techniques: 1. **Sharp Edges Detection** - Identify error-prone APIs, dangerous defaults, and footgun designs 2. **Variant Analysis** - Find similar vulnerabilities across codebases using pattern-based analysis ### When to Use VulnHunter **Activate this skill when:** - Conducting security code reviews or audits - Reviewing third-party dependencies for dangerous patterns - Hunting for variants of known vulnerabilities - Assessing API design for security footguns - Pre-audit reconnaissance of unfamiliar codebases ## Sharp Edges Detection ### Categories of Sharp Edges #### 1. Dangerous Default Configurations Look for configurations that are insecure by default: ``` - CORS: Access-Control-Allow-Origin: * - Debug modes enabled in production - Default credentials or API keys - Permissive file permissions (777, 666) - SSL/TLS verification disabled - Insecure deserialization settings ``` #### 2. Error-Prone APIs **Memory Safety:** ```c // Dangerous: No bounds checking strcpy(), strcat(), sprintf(), gets() memcpy() without size validation // Safer alternatives strncpy(), strncat(), snprintf(), fgets() memcpy_s(...