Guide · Agent skill
How to use the Source Code Hunting agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Source Code Hunting skill is a reference checklist that an AI agent reads when you ask it to examine software source code for security weaknesses. This guide explains what the skill covers, how to install it, how to phrase requests so the agent uses it, and what you need before you start. It is written for readers who have not used agent skills before, and it is meant for authorized security work only.
Source Code HuntingAIPentest/CyberStrikeAI · Apache-2.0 Download the skill Quick start
- 1Confirm authorization. Make sure you own the target or have written permission to test it, and define the scope.
- 2Install the prerequisites. Install git, a secret scanner such as trufflehog or gitleaks, semgrep, and git-dumper if needed. Install Node.js for the JavaScript decoder approach.
- 3Download the skill ZIP. Download the ZIP from this page and unzip it so the skill folder sits in ~/.claude/skills/ or a project's .claude/skills/ directory.
- 4Or upload it in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the skill.
- 5Make a scoped request. Name the target, the scope you are authorized for, and the goal, using topics such as secrets, source leaks or supply-chain review.
- 6Review and verify results. Check findings yourself, use verified-only secret results to prioritize, and rotate any confirmed live credentials.
What the skill makes the agent do
Agent skills are folders of instructions that an AI agent loads when a task matches the skill's description. The source-code-hunting skill is a single file, SKILL.md, containing a dense checklist of source code security techniques. It contains no executable code of its own, so the agent works through the steps using tools you have installed.
- Look for exposed .git folders on websites and try to recover history with git-dumper, then search git log -p --all for deleted sensitive files
- Look for .svn, .DS_Store and composer.lock files as signs of exposure
- Grep for dangerous functions such as exec, system, eval, unserialize, pickle.loads, render and curl_exec, and for hardcoded keys with prefixes like sk-, ghp_ and BEGIN RSA
- Work through a specific JavaScript string-encoding pattern (RC4 with a base64 string array) and rebuild a decoder with Node.js
- Run static scanners such as semgrep and CodeQL, and secret scanners such as trufflehog and gitleaks
- Compare clone-before and clone-after versions of a framework to see what a patch fixed
- Check dependency files (composer.json, npm audit, pip-audit) and CI configurations for supply-chain risks such as dependency confusion, GitHub Actions command injection, self-hosted runner takeover and leaked .npmrc or .pypirc credentials
Install the skill
You can install the skill in one of two ways. Download the skill ZIP from this page and unzip it so that the skill folder ends up in your personal skills directory, ~/.claude/skills/, or in a project's .claude/skills/ folder if you want it available only inside that project.
If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Trigger the skill with natural requests
The agent decides whether to use a skill from its description, which in this case mentions source leaks, secrets, JS deobfuscation, and supply-chain issues. Name those topics directly in your request and state the scope you are authorized to test, so the agent knows the context.
Good requests name a target you own or are permitted to assess and a goal. Vague requests such as 'hack this site' are not what the skill is for.
- Check whether this site I'm authorized to test exposes a .git folder, and if so, recover its history and look for deleted secrets.
- Run semgrep and gitleaks on this repository I own and summarize the findings by severity.
- Review our GitHub Actions workflows for command injection through issue titles.
- Scan the git history and our npm tarballs for leaked credentials, and tell me which ones are still valid using verified-only results.
Example workflow on a repository you own
Suppose you maintain a Node.js project and want to check it before a release. Ask the agent to run a static scan with semgrep, then a secret scan across the full git history with gitleaks or trufflehog. Ask it to audit dependencies with npm audit and to review your CI configuration for untrusted input in workflow expressions.
The skill mentions that trufflehog's --only-verified option separates live secrets from dead ones. Ask the agent to use it so you can prioritize rotation.
semgrep --config=autoWhat you need before you start
The skill names the tools it expects. You install these yourself; the skill does not install them for you. Ensure you have git, one of trufflehog or gitleaks, semgrep, and git-dumper if you plan to test exposed .git folders. CodeQL is optional. Node.js is needed only for the JavaScript decoder approach. For dependency checks, use tools such as npm audit and pip-audit.
- git
- git-dumper (for exposed .git folders)
- trufflehog or gitleaks
- semgrep
- CodeQL (optional)
- Node.js (for the JavaScript decoder approach)
- Dependency tools such as npm audit and pip-audit
Safety notes: scripts and network
The skill itself runs no scripts and makes no network calls. However, the tools it tells the agent to use do, and the techniques involve retrieving data from remote systems. Only point the agent at systems you own or have written permission to test, and keep the scope of each task within what was agreed.
Treat any recovered secrets as sensitive. Do not paste live credentials into public tickets, and rotate any key the scan confirms is valid.
- Confirm written authorization or ownership before any request that touches a live website or third-party code
- Expect the agent to run command-line tools on your machine when you approve them
- Handle recovered credentials and source code as confidential
Tips for better results
The skill is terse and assumes security background. The more specific you are about the target, the tools you have, and the output you want, the more useful the agent's work will be. The notes are written in Chinese with English tool names, so English requests that use the tool names work well.
- Name the exact tool (semgrep, CodeQL, trufflehog, gitleaks) you want used
- Ask for a summary grouped by severity or by file rather than raw output
- Ask for --only-verified results when you need to know which secrets are still live
- Provide the framework or version pair when you want a patch diff analysis
What people use it for
- Auditing your own repository history for secrets that were committed and later deleted
- Running semgrep and CodeQL across a codebase before a release and triaging the results
- Reviewing GitHub Actions workflows for injection risks from issue titles or other untrusted input
- Checking npm or Python dependencies with audit tools and reviewing registry configuration for dependency confusion risk
- Comparing two versions of an open-source framework to see which vulnerabilities a patch addressed, within an authorized research project
Frequently asked questions
How do I install the source-code-hunting skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. In the Claude apps, you can instead open Settings, go to Capabilities, and upload it under Skills.
What do I need installed to use it?
The skill names git, git-dumper for exposed .git folders, trufflehog or gitleaks, and semgrep. CodeQL is optional, Node.js is needed only for the JavaScript decoder approach, and npm audit or pip-audit cover dependency checks. The skill does not install these for you.
Is the source-code-hunting skill free?
The skill is listed under the Apache-2.0 licence. Check the licence file in the source repository for the terms that apply to your use. The tools it references are separate projects with their own licences.
Does the skill run scripts or use the network?
The skill file contains no executable code, and the skill itself runs no scripts and makes no network calls. The tools it tells the agent to use can run commands and fetch remote data, so only use it against systems you are authorized to test.
Can I use this skill on a website I don't own?
No. The techniques describe exploiting exposed .git folders and leaked secrets, so they are only appropriate for authorized penetration tests and research with written permission, or for auditing systems you own.
Is this skill a good beginner tutorial for source code security?
Not on its own. The file is a terse cheat sheet that assumes security background and names tools without explaining how to run them. Beginners should learn the individual tools first and use the skill as a reminder of techniques to check.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a penetration tester, security researcher, or security engineer who already understands tools like semgrep, trufflehog, and gitleaks, and you need a checklist for authorized source code and CI reviews. Pick a tutorial-style resource or a dedicated beginner course if you need step-by-step instructions for running each tool.
Download the skill