DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to verify that a security fix really closes the finding with Vuln Hunter

Use a separate read-only agent to give a per-finding verdict on whether a fix worked.

Authorization notice. Vuln Hunter is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA security reviewer or release manager who needs evidence that a merged fix closes the original finding, not just an assumption.

The problemTeams often mark a finding as fixed on the strength of a code change, without an independent check that the exploit is now blocked.

The outcomeA per-finding verdict from a read-only verifier that shows whether each remediated finding is closed.

What you need first

  • Source code you own or are authorized to audit
  • Your own model access, using the most capable reasoning model your agent harness offers
  • An agent harness with a skills directory and subagent support
  • Python and git installed locally

Steps

  1. Collect the finding IDs that have a fix pending verification from the earlier hunt and fix runs
  2. Make sure the fixed code is checked out in your repository
  3. Open your agent harness in that repository
  4. Run /vulnhunt-fix-verify against the finding IDs you collected
  5. Read the per-finding verdict and reopen any finding the verifier does not mark as remediated

Prompt for your agent

Using the VulnHunter repo at nealbridges/VulnHunter, run the /vulnhunt-fix-verify skill on the findings <finding IDs> in <target repo path>. Return one verdict per finding, stating whether it was remediated. Verify that the verifier made no code changes, since it is described as read-only.

Caveat. The README describes the verifier as independent and read-only, but the separate adversarial verifier for the hunt phase is on the roadmap, not shipped.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page