From find-cve-agent
Detects decompression bomb vulnerabilities in JS/TS/Python/Go where compressed inputs expand to exhaust memory, targeting buffer-based decompression without size limits. Audit compression libs and file uploads.
npx claudepluginhub byamb4/find-cve-agentThis skill uses the workspace's default tool permissions.
Audit archive/compression libraries, file upload handlers, content-encoding processors, and any package that decompresses user-supplied data.
Detects recursion DoS vulnerabilities like stack overflow and OOM in recursive parsers, tree walkers, serializers without depth limits. Audits JS/TS/Python/Go code via grep patterns and nested input tests.
Scans Python code for security vulnerabilities and anti-patterns using Bandit SAST with CWE/OWASP mappings. Identifies secrets, injections, insecure APIs; generates CI/CD reports with remediation.
Use when performing penetration testing targeting memory corruption vulnerabilities in native applications. Keywords: buffer overflow, heap overflow, use-after-free, integer overflow, format string, stack overflow, type confusion, out-of-bounds read/write
Share bugs, ideas, or general feedback.
Audit archive/compression libraries, file upload handlers, content-encoding processors, and any package that decompresses user-supplied data.
Buffer-based decompression is vulnerable: the entire decompressed output is loaded into memory at once. A 1KB compressed payload can expand to 1GB+.
Stream-based MAY have backpressure: but only if the consumer applies it. Many stream implementations still buffer the entire output.
# JavaScript
grep -rn "zlib\.gunzip\|zlib\.inflate\|zlib\.unzip\|zlib\.brotli" .
grep -rn "gunzipSync\|inflateSync\|unzipSync\|brotliDecompress" .
grep -rn "pako\|fflate\|lz-string\|snappy" .
grep -rn "decompress\|decompressSync\|uncompress" .
# Python
grep -rn "zlib\.decompress\|gzip\.decompress\|bz2\.decompress" .
grep -rn "lzma\.decompress\|snappy\.decompress" .
# Go
grep -rn "gzip\.NewReader\|zlib\.NewReader\|flate\.NewReader" .
grep -rn "compress/gzip\|compress/zlib\|compress/flate" .
grep -rn "maxSize\|maxOutput\|maxLength\|MAX_SIZE\|outputLimit\|sizeLimit" .
grep -rn "ratio\|compressionRatio\|maxRatio" .
Buffer-based (VULNERABLE):
zlib.gunzipSync(input) // Entire output in memory
zlib.gunzip(input, (err, result) => {}) // Callback with full buffer
Stream-based (CHECK):
input.pipe(zlib.createGunzip()).pipe(output) // Streaming, may have backpressure
Even stream-based can be vulnerable if:
const chunks = []; stream.on('data', c => chunks.push(c))