# AI use cases for Vuln Hunter (nealbridges/VulnHunter)

Repo: [nealbridges/VulnHunter](https://github.com/nealbridges/VulnHunter) | Use cases: 5 | Page: https://dedupedai.com/use-cases/nealbridges-vulnhunter/

VulnHunter is an open-source agentic AI security scanner that traces attacker-reachable entry points to exploitable flaws, proves them with proof-of-concept tests, and proposes test-first fixes.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- Hunt exploitable flaws in your own codebase: https://dedupedai.com/use-cases/nealbridges-vulnhunter/hunt-exploitable-flaws-in-your-code/
- Fix a confirmed finding with a failing test first: https://dedupedai.com/use-cases/nealbridges-vulnhunter/fix-a-confirmed-finding-test-first/
- Verify that a security fix really closes the finding: https://dedupedai.com/use-cases/nealbridges-vulnhunter/verify-that-a-fix-really-works/
- Run unattended scans across several repositories: https://dedupedai.com/use-cases/nealbridges-vulnhunter/run-scheduled-scans-across-repos/
- Port the skills to a harness you already run: https://dedupedai.com/use-cases/nealbridges-vulnhunter/port-the-skills-to-your-agent-harness/

## How to hunt exploitable flaws in your own codebase with Vuln Hunter

Repo: [nealbridges/VulnHunter](https://github.com/nealbridges/VulnHunter) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README

Run the attacker-first scanner to get verified issues, each with an executable exploit and a proposed fix.

**Who it is for:** An application security engineer preparing a release of a service they own, who wants findings that are proven exploitable rather than pattern matches.

**The problem:** Traditional scanners flag suspicious code patterns and produce many false positives, so teams spend time triaging issues that cannot be exploited.

**The outcome:** A short list of verified issues, each with an executable exploit and a proposed fix, after falsification filtering removes unsupported findings.

### Steps

1. Clone the repository with `git clone https://github.com/nealbridges/VulnHunter` (inferred, check the README)
2. Run the installer from the repo folder with `bash install.sh`, setting VULNHUNT_SKILLS_DIR for your harness first if it does not use a default location (inferred, check the README)
3. Open your agent harness in the folder of the code you own and are authorized to audit
4. Run `/vulnhunt` to start the hunt from entry points toward dangerous sinks
5. Review each confirmed finding, its exploit, and its proposed fix before acting on it

### Prompt to paste into your agent

```text
Using the VulnHunter repo at nealbridges/VulnHunter, run the /vulnhunt skill against <target repo path>, which I am authorized to audit. Return a list of confirmed findings with each finding's entry point, sink, and exploit status. Verify that every listed finding includes an executable exploit or is labeled as lacking one.
```

### Caveat

Exploit execution is described as ideal rather than guaranteed, and the Docker-first sandbox for exploit validation is still in progress in this fork.

Risk, remote script: The installer runs from a cloned repo, so read install.sh before you execute it on a machine that holds code you care about.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/nealbridges-vulnhunter/hunt-exploitable-flaws-in-your-code/

## How to fix a confirmed finding with a failing test first with Vuln Hunter

Repo: [nealbridges/VulnHunter](https://github.com/nealbridges/VulnHunter) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README

Turn one verified finding into a red-then-green security fix and a reviewable pull request.

**Who it is for:** A developer who has a confirmed finding from a hunt and needs a fix that is proven by a test before it is merged.

**The problem:** Security fixes often ship without a test that shows the exploit is blocked, so the same flaw can return later.

**The outcome:** An exploit demo, a failing security test, a code fix that makes it pass, and a pull request that is ready for review.

### Steps

1. Confirm the finding you want to fix from the output of a previous `/vulnhunt` run
2. Open your agent harness in the repository that contains the finding
3. Run `/vulnhunter-fix` and name the finding you want to remediate
4. Check that the agent wrote the exploit demo and a security test that fails before the fix (RED)
5. Check that the code fix makes the test pass (GREEN) and that the exploit is blocked without regressions before you review the pull request

### Prompt to paste into your agent

```text
Using the VulnHunter repo at nealbridges/VulnHunter, run the /vulnhunter-fix skill on the finding <finding ID> in <target repo path>. Return the exploit demo, the RED test output, the GREEN test output, and a pull request link or diff. Verify that the security test fails before the code change and passes after it.
```

### Caveat

The skill cuts a reviewable PR, so a human reviewer still needs to read the change before it merges.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/nealbridges-vulnhunter/fix-a-confirmed-finding-test-first/

## How to verify that a security fix really closes the finding with Vuln Hunter

Repo: [nealbridges/VulnHunter](https://github.com/nealbridges/VulnHunter) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README

Use a separate read-only agent to give a per-finding verdict on whether a fix worked.

**Who it is for:** A security reviewer or release manager who needs evidence that a merged fix closes the original finding, not just an assumption.

**The problem:** Teams often mark a finding as fixed on the strength of a code change, without an independent check that the exploit is now blocked.

**The outcome:** A per-finding verdict from a read-only verifier that shows whether each remediated finding is closed.

### Steps

1. Collect the finding IDs that have a fix pending verification from the earlier hunt and fix runs
2. Make sure the fixed code is checked out in your repository
3. Open your agent harness in that repository
4. Run `/vulnhunt-fix-verify` against the finding IDs you collected
5. Read the per-finding verdict and reopen any finding the verifier does not mark as remediated

### Prompt to paste into your agent

```text
Using the VulnHunter repo at nealbridges/VulnHunter, run the /vulnhunt-fix-verify skill on the findings <finding IDs> in <target repo path>. Return one verdict per finding, stating whether it was remediated. Verify that the verifier made no code changes, since it is described as read-only.
```

### Caveat

The README describes the verifier as independent and read-only, but the separate adversarial verifier for the hunt phase is on the roadmap, not shipped.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/nealbridges-vulnhunter/verify-that-a-fix-really-works/

## How to run unattended scans across several repositories with Vuln Hunter

Repo: [nealbridges/VulnHunter](https://github.com/nealbridges/VulnHunter) | Difficulty: Advanced | Time: 1 hour | Basis: From the README

Use the vulnhunter-run operator to clone, hunt, and record results without manual steps.

**Who it is for:** A platform or security team lead who wants a recurring scan of many services and a scan manifest for each run.

**The problem:** A one-off scan is useful for a demo but does not keep watch over code that changes every day.

**The outcome:** Scan results and a validated scan manifest for each repository, produced by an operator that follows explicit stop rules.

### Steps

1. Install the skills and the vulnhunter-run agent definition using the installer described in the repo
2. Set the environment variables VULNHUNT_SKILLS_DIR, VULNHUNT_AGENTS_DIR, and VULNHUNT_MODEL for your harness
3. Invoke the vulnhunter-run skill with the list of repositories you want scanned
4. Locate the scan results and the scan manifest the operator writes for each repository
5. Check the manifest validation output before you act on any finding

### Prompt to paste into your agent

```text
Using the VulnHunter repo at nealbridges/VulnHunter, run the vulnhunter-run operator on the repositories <repo list>. Return the scan manifest and the results location for each repository. Verify that the manifest passes validation and that the operator stopped at its explicit stop rules where a repository could not be cloned or scanned.
```

### Caveat

The README describes the vulnhunter-agent and harness/ folders for unattended and batch runs, but it does not give their setup steps, so check their own docs before scheduling.

Risk, credentials: The operator clones repositories, so give it only the access tokens your harness needs and scope them to the repositories you are authorized to scan.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/nealbridges-vulnhunter/run-scheduled-scans-across-repos/

## How to port the skills to a harness you already run with Vuln Hunter

Repo: [nealbridges/VulnHunter](https://github.com/nealbridges/VulnHunter) | Difficulty: Advanced | Time: 1 hour 30 minutes | Basis: From the README

Point the skill and model settings at your own agent harness through environment variables.

**Who it is for:** A team that runs a non-Claude agent harness and wants the same vulnerability method inside it.

**The problem:** A security method that installs into only one agent harness stops being a team capability and becomes a vendor feature.

**The outcome:** The Vuln Hunter skills load in your harness, and the hunt, fix, and verify steps run there with your chosen model.

### Steps

1. Find the skills directory and subagent directory your harness reads from
2. Set VULNHUNT_SKILLS_DIR and VULNHUNT_AGENTS_DIR to those directories
3. Set VULNHUNT_BIN_DIR and VULNHUNT_HOST_CMD if your harness needs a launcher or host command
4. Set VULNHUNT_MODEL to the most capable reasoning model you have access to
5. Run `/vulnhunt` once on a small test repository to confirm the skill loads in your harness

### Prompt to paste into your agent

```text
Using the VulnHunter repo at nealbridges/VulnHunter, configure the environment variables VULNHUNT_SKILLS_DIR, VULNHUNT_AGENTS_DIR, and VULNHUNT_MODEL for my harness, then run /vulnhunt on <test repo path>. Return the configuration used and whether the skill loaded. Verify that the run used the model I set and not a hardcoded default.
```

### Caveat

The README lists the environment variables but does not say how each harness discovers skills, so you may need to confirm the directory layout with your harness's own documentation.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/nealbridges-vulnhunter/port-the-skills-to-your-agent-harness/