/vuln-scan
Static vulnerability review of a source tree. Produces
VULN-FINDINGS.json
(+ a human-readable
.md
) that
/triage
ingests directly.
This skill does not execute code.
It reads source and reasons about it.
For execution-verified findings (ASAN crashes, reproducing PoCs), point the
user at
vuln-pipeline run
— see README Step 2.
Tool fallbacks.
Prefer the dedicated Glob and Grep tools. Some sessions
do not provision them —
allowed-tools
is a permission filter, not a loader,
so listing them here does not make them appear. When Glob/Grep are
unavailable, fall back to the read-only Bash commands whitelisted above:
rg --files
/
ls -R
for enumeration,
rg -n
/
grep -rn
for
search,
wc
/
head
/
file
for sniffing. These are the ONLY permitted
Bash commands; do not write helper scripts or pipe target content into a
shell interpreter.
Arguments
Show more
Installs
886
Repository
anthropics/defe…-harness
GitHub Stars
6.9K
First Seen
Jun 4, 2026
Security Audits
Gen Agent Trust Hub
Pass
Socket
Pass
Snyk
Fail