DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to port the skills to a harness you already run with Vuln Hunter

Point the skill and model settings at your own agent harness through environment variables.

Authorization notice. Vuln Hunter is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA team that runs a non-Claude agent harness and wants the same vulnerability method inside it.

The problemA security method that installs into only one agent harness stops being a team capability and becomes a vendor feature.

The outcomeThe Vuln Hunter skills load in your harness, and the hunt, fix, and verify steps run there with your chosen model.

What you need first

  • Source code you own or are authorized to audit
  • Your own model access, using the most capable reasoning model your agent harness offers
  • An agent harness with a skills directory and subagent support
  • Python and git installed locally

Steps

  1. Find the skills directory and subagent directory your harness reads from
  2. Set VULNHUNT_SKILLS_DIR and VULNHUNT_AGENTS_DIR to those directories
  3. Set VULNHUNT_BIN_DIR and VULNHUNT_HOST_CMD if your harness needs a launcher or host command
  4. Set VULNHUNT_MODEL to the most capable reasoning model you have access to
  5. Run /vulnhunt once on a small test repository to confirm the skill loads in your harness

Prompt for your agent

Using the VulnHunter repo at nealbridges/VulnHunter, configure the environment variables VULNHUNT_SKILLS_DIR, VULNHUNT_AGENTS_DIR, and VULNHUNT_MODEL for my harness, then run /vulnhunt on <test repo path>. Return the configuration used and whether the skill loaded. Verify that the run used the model I set and not a hardcoded default.

Caveat. The README lists the environment variables but does not say how each harness discovers skills, so you may need to confirm the directory layout with your harness's own documentation.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page