From find-cve-agent
Multiplies security findings by extracting vulnerable patterns from confirmed issues and searching similar packages via grep.app regex in JS/TS/Python files.
npx claudepluginhub byamb4/find-cve-agentThis skill uses the workspace's default tool permissions.
After confirming a vulnerability in package-A, use this technique to find the same vulnerable pattern in packages B through Z. One finding can multiply into 5-20 findings.
Finds similar bugs and vulnerabilities across codebases via iterative pattern generalization using ripgrep, Semgrep, and CodeQL after initial issue discovery.
Finds similar vulnerabilities and bugs across codebases using iterative pattern generalization with ripgrep, Semgrep, and CodeQL. Use for hunting bug variants, building queries, and systematic audits after initial issue.
Discovers high-quality npm/PyPI/GitHub packages for vulnerability audits using criteria like downloads/stars/maintenance and strategies like npm/gh search. Useful for new security research cycles.
Share bugs, ideas, or general feedback.
After confirming a vulnerability in package-A, use this technique to find the same vulnerable pattern in packages B through Z. One finding can multiply into 5-20 findings.
| Starting Finding | Pattern | Typical Yield |
|---|---|---|
| Entity expansion in XML parser A | All XML parsers with no entity limit | 3-8 findings |
| Zip Slip in archive lib A | All archive extraction libs | 2-5 findings |
| Proto pollution in merge lib A | All deep merge/clone libs | 5-10 findings |
| ReDoS in validator A | All validators using same regex pattern | 3-7 findings |
| Code injection in schema validator A | All schema validators with code gen | 2-5 findings |
| Recursion DoS in serializer A | All recursive serializers | 5-15 findings |
| Method clobbering in parser A | All parsers creating objects from input | 3-8 findings |
Before cross-pollinating, ensure the original finding is confirmed:
Identify the core vulnerable code pattern as a regex:
# Example: recursive function without depth limit
Pattern: function\s+\w+\(.*\)\s*\{.*\w+\( (self-call without depth check)
# Example: new Function with template literal
Pattern: new\s+Function\s*\(.*\$\{
# Example: path.join without startsWith check
Pattern: path\.join\(.*req\.(params|body|query)
https://grep.app/search?q=PATTERN®exp=true&filter[lang][0]=JavaScript
Tips:
For each match:
For each confirmed vulnerable package:
https://grep.app/search?q=QUERY®exp=true&filter[lang][0]=LANGUAGE
q: Search query (URL-encoded)regexp: true/false for regex modefilter[lang][0]: Language filter (JavaScript, Python, Go, Ruby, etc.)page: Pagination# new Function with interpolation
new\s+Function\s*\(.*\$\{
# eval with concatenation
eval\s*\(.*\+
# Recursive function without depth
function\s+\w+.*\{[^}]*\1\(
# path.join with user input
path\.join\(.*req\.(params|body|query)
# XML parser without entity config
new\s+XMLParser\s*\(\s*\)
# Deep merge without proto check
function\s+\w*merge.*for.*in.*source.*\[key\]
If you have multiple repos cloned locally:
# Search across all cloned repos
rg "PATTERN" targets/ --type js --glob '!node_modules'
# Count matches per repo
rg "PATTERN" targets/ --type js --glob '!node_modules' --count
When grep.app returns 50+ matches: