From find-cve-agent
Multiplies security findings by extracting vulnerable patterns from confirmed issues and searching similar packages via grep.app regex in JS/TS/Python files.
How this skill is triggered — by the user, by Claude, or both
Slash command
/find-cve-agent:cross-pollinationThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
After confirming a vulnerability in package-A, use this technique to find the same vulnerable pattern in packages B through Z. One finding can multiply into 5-20 findings.
After confirming a vulnerability in package-A, use this technique to find the same vulnerable pattern in packages B through Z. One finding can multiply into 5-20 findings.
| Starting Finding | Pattern | Typical Yield |
|---|---|---|
| Entity expansion in XML parser A | All XML parsers with no entity limit | 3-8 findings |
| Zip Slip in archive lib A | All archive extraction libs | 2-5 findings |
| Proto pollution in merge lib A | All deep merge/clone libs | 5-10 findings |
| ReDoS in validator A | All validators using same regex pattern | 3-7 findings |
| Code injection in schema validator A | All schema validators with code gen | 2-5 findings |
| Recursion DoS in serializer A | All recursive serializers | 5-15 findings |
| Method clobbering in parser A | All parsers creating objects from input | 3-8 findings |
Before cross-pollinating, ensure the original finding is confirmed:
Identify the core vulnerable code pattern as a regex:
# Example: recursive function without depth limit
Pattern: function\s+\w+\(.*\)\s*\{.*\w+\( (self-call without depth check)
# Example: new Function with template literal
Pattern: new\s+Function\s*\(.*\$\{
# Example: path.join without startsWith check
Pattern: path\.join\(.*req\.(params|body|query)
https://grep.app/search?q=PATTERN®exp=true&filter[lang][0]=JavaScript
Tips:
For each match:
For each confirmed vulnerable package:
https://grep.app/search?q=QUERY®exp=true&filter[lang][0]=LANGUAGE
q: Search query (URL-encoded)regexp: true/false for regex modefilter[lang][0]: Language filter (JavaScript, Python, Go, Ruby, etc.)page: Pagination# new Function with interpolation
new\s+Function\s*\(.*\$\{
# eval with concatenation
eval\s*\(.*\+
# Recursive function without depth
function\s+\w+.*\{[^}]*\1\(
# path.join with user input
path\.join\(.*req\.(params|body|query)
# XML parser without entity config
new\s+XMLParser\s*\(\s*\)
# Deep merge without proto check
function\s+\w*merge.*for.*in.*source.*\[key\]
If you have multiple repos cloned locally:
# Search across all cloned repos
rg "PATTERN" targets/ --type js --glob '!node_modules'
# Count matches per repo
rg "PATTERN" targets/ --type js --glob '!node_modules' --count
When grep.app returns 50+ matches:
npx claudepluginhub byamb4/find-cve-agentFinds similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, or performing systematic code audits after finding an initial issue.
Finds similar vulnerabilities and bugs across codebases using pattern-based analysis. Guides iterative generalization from known bugs to broader patterns with CodeQL/Semgrep.
Finds similar bugs and vulnerabilities across codebases via iterative pattern generalization using ripgrep, Semgrep, and CodeQL after initial issue discovery.