vulnhunter

Identify security vulnerabilities and variants across multilingual codebases using Semgrep, CodeQL, and manual review.

116|9|Updated Feb 18, 2026
One-click install
npx skills add https://github.com/elophanto/EloPhanto --skill vulnhunter-elophanto
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnhunter
Source: https://github.com/elophanto/EloPhanto/tree/main/skills/vulnhunter-security
Command: npx skills add https://github.com/elophanto/EloPhanto --skill vulnhunter-elophanto

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams need to quickly identify dangerous patterns, misconfigurations, and vulnerability variants across large codebases to reduce audit time and exposure.

Core Features & Use Cases

  • Sharp edges detection for authentication, cryptography, input handling, and deserialization
  • Variant analysis to identify similar vulnerabilities across files, languages, and dependencies
  • Phase-driven workflow (Reconnaissance, Sharp Edges Scan, Variant Hunting, Reporting)
  • Reusable templates and resources to document findings and remediation

Quick Start

Scan a codebase to surface vulnerabilities and generate a formal variant-analysis report.

Frequently Asked Questions about vulnhunter

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find vulnerability variants across a multilingual codebase?▼

Vulnerability variant analysis identifies similar security flaws across different files and languages by applying a structured workflow using Semgrep, CodeQL, and manual review to detect and assess risks.

What is the best way to automate pre-audit security reconnaissance for code review?▼

Pre-audit security reconnaissance is automated through a phase-driven workflow that scans for sharp edges in authentication, cryptography, and deserialization, generating a formal report to plan remediation.

How does variant analysis work with Semgrep and CodeQL?▼

Variant analysis with Semgrep and CodeQL works by scanning codebases for dangerous patterns and misconfigurations, identifying similar vulnerability variants across files to enable proactive risk mitigation.

Can I use this for security reviews on multilingual codebases?▼

Yes, this variant-analysis workflow supports multilingual codebases and security reviews by detecting dangerous patterns in input handling and cryptography, satisfying structured pre-audit remediation planning.

What types of security vulnerabilities and sharp edges does this code review process detect?▼

The code review process detects security vulnerabilities and sharp edges specifically in authentication, cryptography, input handling, and deserialization to reduce exposure and audit time.

How do I generate a formal variant-analysis report after scanning for vulnerabilities?▼

You generate a formal variant-analysis report by completing the phase-driven workflow, which uses reusable templates and resources to document findings and remediation steps for identified vulnerabilities.