Guide · Agent skill
How to use the zero-day-discovery agent skill: setup and examples
Updated · written with AI from the project's own documentation and checked against our catalogue data
zero-day-discovery is an agent skill: a set of written instructions that tells an AI agent how to look for vulnerabilities when public vulnerability databases have nothing useful. It is aimed at security researchers doing authorized work, red teams in sanctioned penetration tests, and students learning vulnerability research. After this guide you will know how to install the skill, how to phrase requests that trigger it, what methods it asks the agent to apply, and what limits to respect.
Zero-Day Discovery EngineAIPentest/CyberStrikeAI · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Get the zero-day-discovery skill as a ZIP file from the skill's page on the directory.
- 2Unzip into a skills folder. For personal use, unzip into ~/.claude/skills/. For a single project, unzip into that project's .claude/skills/ folder.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill there.
- 4Confirm your authorization. Make sure you have written permission or own the code, since the skill does not check scope.
- 5Make a specific request. Name the goal, the material (source, patch diff, API or protocol) and the scope, for example asking for variant analysis of a given CVE patch.
- 6Install optional tools if needed. If you want the agent to run analysis tools, make sure the ones you need, such as CodeQL, Semgrep or a fuzzer, are available in your environment.
- 7Verify findings. Ask for a reproducible minimal PoC, a root cause, proven impact and false-positive exclusion before accepting any result.
What the skill makes the agent do
The skill changes the agent's approach from matching known vulnerabilities to reasoning about how code, protocols or APIs work and where they might break. Its stated premise is that zero-day discovery is a method rather than luck.
The file lays out five main routes: variant analysis, patch gap analysis, differential testing, fuzzing, and taint reasoning. It also covers rebuilding exploits from published patch diffs for n-day weaponization, and a set of 'hunter mindset' questions to ask of any code, endpoint or protocol.
- Variant analysis: take a CVE patch, extract the vulnerability pattern, search the codebase for other places with the same pattern, and treat locations the patch does not cover as candidates.
- Patch gap analysis: read the patch's filter logic and look for bypasses such as missed encodings, equivalent functions or aliases.
- Differential testing: find cases where two components interpret the same input differently, such as a WAF versus a backend, or a validator versus an executor.
- Fuzzing: write a harness around code that handles untrusted input, build corpora or dictionaries, and triage crashes for reproducibility, controllability and exploitability.
- Taint reasoning: trace untrusted sources such as parameters, headers or deserialized fields to dangerous sinks such as exec, SQL or templates without effective sanitization.
- N-day weaponization: when an advisory exists but no public proof of concept does, rebuild an exploit from the patch diff, get it working in a local test environment, then test against the target.
How to install the zero-day-discovery skill
The skill is distributed as a ZIP file from the download page. There are two routes described in the source material: place the unzipped skill in a skills folder that your agent tool reads, or upload it through the Claude apps.
For a personal install, unzip the file into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Download the ZIP from the skill's page on the directory.
- Personal use: unzip into ~/.claude/skills/.
- Project use: unzip into the project's .claude/skills/ folder.
- Claude apps: upload it under Settings → Capabilities → Skills.
~/.claude/skills/How to trigger the skill with natural requests
The skill's description says to use it when public vulnerabilities have not been found and you need to discover a zero-day or weaponize an n-day. Describe your situation in plain terms and name the target and the authorization, and the agent can pick up the method. Use wording that matches those situations.
Good requests state the goal, the material you have (source code, a binary pair before and after a patch, an API, a protocol description) and the scope you are authorized to test.
- Ask for variant analysis: 'I have this CVE patch from our repo. Find other places in the codebase with the same pattern, within the scope we agreed.'
- Ask for a patch review: 'Read this patch's filter and tell me which encodings or aliases it might miss.'
- Ask for fuzzing setup: 'Write a libFuzzer harness around this parser function that handles untrusted input.'
- Ask for taint tracing: 'Trace user-controlled fields in this service to any SQL or template sinks.'
- Ask for hunter-style review: 'Walk through this upload handler with trust-boundary and edge-case questions.'
What the skill needs
The file names several analysis tools: CodeQL, Semgrep, Joern, AFL++, libFuzzer, boofuzz, radamsa, RESTler, bindiff and diaphora. The source describes these as analysis tools named in the file, and marks them as optional. The agent still needs to run them and reason about results.
The file does not specify any API keys or accounts. It states that it runs no scripts and uses no network access. You still need an agent environment that can use the tools you choose, and you need your own authorization and scope.
- Optional tools named in the file: CodeQL, Semgrep, Joern, AFL++, libFuzzer, boofuzz, radamsa, RESTler, bindiff, diaphora.
- No API keys or accounts are specified in the file.
- The file does not run scripts and does not use the network itself.
Safety notes: scripts, network and authorization
The content is offensive. The skill does not check scope or permission. Only use it on systems you own, on in-scope code, or under written authorization such as a sanctioned penetration test.
Because the skill itself runs no scripts and uses no network, any actual scanning, fuzzing or exploitation happens through the tools the agent runs, in the environment you give it. Review what the agent executes before you allow it.
- Use only on your own or in-scope code, or under written authorization.
- The skill does not verify scope; that check is your responsibility.
- Review commands the agent proposes, especially fuzzers and network-facing tests.
- Test exploits in a local test environment before running them against any target, as the skill itself suggests for n-day work.
Tips for getting useful results
The skill is a methodology prompt, not a turnkey scanner. Results depend on the material you provide and on the tools you let the agent run. Narrow, specific requests tend to work better than asking for 'find all zero-days'.
The file sets a verification bar that is stricter than for a known CVE. Ask the agent to meet it before you accept a finding.
- Give the agent the exact code, diff or protocol description to work on.
- Ask for one route at a time, such as variant analysis first, then taint tracing.
- Require a reproducible minimal proof of concept, a clear root cause (which line or assumption), proven impact (actual read, write or execution), and exclusion of false positives.
- Ask the agent to list the assumptions it made about trust boundaries and input parsing.
What people use it for
- Variant analysis of a patched CVE in your own codebase, to find sibling code paths the patch missed.
- Reviewing a WAF or input filter for encoding or alias bypasses during an authorized penetration test.
- Setting up a libFuzzer or AFL++ harness around a parser that handles untrusted input.
- Tracing user-controlled fields to SQL, exec or template sinks in source code you are allowed to audit.
- Learning vulnerability research methods such as variant analysis and fuzzing with a structured workflow.
Frequently asked questions
How do I install the zero-day-discovery agent skill?
Download the ZIP from the skill's page, then unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder for one project. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
Does zero-day-discovery need an API key or account?
The file does not specify any API keys or accounts. It names optional analysis tools such as CodeQL, Semgrep, AFL++ and libFuzzer, which you would need to have available if the agent is to run them.
Is the zero-day-discovery skill free to use?
The skill is published under the Apache-2.0 licence, as listed on its page. Check the licence text for the terms that apply to your use.
Does the skill run scripts or access the network?
According to the listing, the skill runs no scripts and uses no network access. Any scanning or testing happens through tools the agent runs in your environment, so review those actions.
Can I use this skill to test systems I do not own?
Only with written authorization, such as a sanctioned penetration test or an agreed scope. The content is offensive and the skill does not check scope or permission, so that responsibility sits with you.
How is this different from a vulnerability scanner?
The skill is a methodology prompt rather than a turnkey scanner. It guides the agent through reasoning and methods such as variant analysis and taint tracing, and the agent still needs to run tools and interpret the results.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security researchers doing authorized vulnerability research, red teams in sanctioned tests, and students who want a structured method for variant analysis and fuzzing. Skip it if you need a turnkey scanner, if your task is not security-related, or if you cannot work within written authorization.
Download the skill