DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to fix a confirmed finding with a failing test first with Vuln Hunter

Turn one verified finding into a red-then-green security fix and a reviewable pull request.

Authorization notice. Vuln Hunter is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA developer who has a confirmed finding from a hunt and needs a fix that is proven by a test before it is merged.

The problemSecurity fixes often ship without a test that shows the exploit is blocked, so the same flaw can return later.

The outcomeAn exploit demo, a failing security test, a code fix that makes it pass, and a pull request that is ready for review.

What you need first

  • Source code you own or are authorized to audit
  • Your own model access, using the most capable reasoning model your agent harness offers
  • An agent harness with a skills directory and subagent support
  • Python and git installed locally

Steps

  1. Confirm the finding you want to fix from the output of a previous /vulnhunt run
  2. Open your agent harness in the repository that contains the finding
  3. Run /vulnhunter-fix and name the finding you want to remediate
  4. Check that the agent wrote the exploit demo and a security test that fails before the fix (RED)
  5. Check that the code fix makes the test pass (GREEN) and that the exploit is blocked without regressions before you review the pull request

Prompt for your agent

Using the VulnHunter repo at nealbridges/VulnHunter, run the /vulnhunter-fix skill on the finding <finding ID> in <target repo path>. Return the exploit demo, the RED test output, the GREEN test output, and a pull request link or diff. Verify that the security test fails before the code change and passes after it.

Caveat. The skill cuts a reviewable PR, so a human reviewer still needs to read the change before it merges.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page