vulnerability-discovery git:20260424.a607dbdA

Immutable. This exact content is served forever at /api/v1/blob/d4d2a84098f92ce2.

---
name: vulnerability-discovery
description: 'Use when you need a repeatable workflow to discover and document likely application security vulnerabilities with evidence and standard mapping.'
argument-hint: 'Provide the target paths and max findings, for example: app plus static/js, top 5 findings'
user-invocable: true
---

# Vulnerability Discovery Skill

## When to use

Use for initial discovery and triage preparation.

## Inputs

- Target scope (files or folders)
- Maximum findings to return
- Optional focus areas (prompt injection, XSS, authz, config)

## Procedure

1. Scan for high-risk patterns in backend endpoints, request handling, and state mutation.
2. Scan frontend rendering paths for unsafe HTML handling and client-side trust assumptions.
3. Scan configuration and error paths for hardening gaps.
4. Build findings with severity, evidence, and control mapping.
5. Mark uncertain items as "Needs verification".

## Required output fields

- `id`
- `title`
- `severity`
- `evidence`
- `control_ids`
- `rationale`
- `status` (`confirmed` or `needs_verification`)

## Control mapping source

Use `docs/appsec-demo/appsec-baseline-standard.md` for control IDs.