npx claudepluginhub darklegend5/heiba-claude-codeThis skill uses the workspace's default tool permissions.
Use this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review.
Audits UI buttons and touchpoints by tracing state changes in handlers to find canceling side effects, race conditions, and inconsistent final states after refactors or for user-reported bugs.
Provides ClickHouse patterns for MergeTree schemas, query optimization, aggregations, window functions, joins, and data ingestion for high-performance analytics.
Orchestrates multi-agent coding tasks via Claude DevFleet: plans projects into mission DAGs, dispatches parallel agents to isolated git worktrees, monitors progress, and retrieves structured reports.
Use this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review.
Bias toward remotely reachable, user-controlled attack paths and throw away patterns that platforms routinely reject as informative or out of scope.
These are the kinds of issues that consistently matter:
| Pattern | CWE | Typical impact |
|---|---|---|
| SSRF through user-controlled URLs | CWE-918 | internal network access, cloud metadata theft |
| Auth bypass in middleware or API guards | CWE-287 | unauthorized account or data access |
| Remote deserialization or upload-to-RCE paths | CWE-502 | code execution |
| SQL injection in reachable endpoints | CWE-89 | data exfiltration, auth bypass, data destruction |
| Command injection in request handlers | CWE-78 | code execution |
| Path traversal in file-serving paths | CWE-22 | arbitrary file read or write |
| Auto-triggered XSS | CWE-79 | session theft, admin compromise |
These are usually low-signal or out of bounty scope unless the program says otherwise:
pickle.loads, torch.load, or equivalent with no remote patheval() or exec() in CLI-only toolingshell=True on fully hardcoded commandssemgrep --config=auto --severity=ERROR --severity=WARNING --json
Then manually filter:
## Description
[What the vulnerability is and why it matters]
## Vulnerable Code
[File path, line range, and a small snippet]
## Proof of Concept
[Minimal working request or script]
## Impact
[What the attacker can achieve]
## Affected Version
[Version, commit, or deployment target tested]
Before submitting: