Skip to content
Get packs

Source Code Hunting

Guides an agent through finding leaked source, secrets, risky code and supply-chain flaws

Source Download skill
Repository
AIPentest/CyberStrikeAI
Stars
8,323
Licence
Apache-2.0
Files
1 file

What it does

This skill gives an AI agent a checklist of techniques for examining software source code for security weaknesses. It covers finding exposed .git folders on websites, grepping for dangerous functions and hardcoded keys, deobfuscating a specific JavaScript string-encoding pattern, running scanners like semgrep, CodeQL, trufflehog and gitleaks, comparing patched versions to locate vulnerabilities, and checking CI and dependency configurations for supply-chain risks. The notes are written in Chinese with English tool names, and the file itself contains no executable code.

Great for

  • Penetration testers and security researchers doing authorized source code reviews
  • Security engineers auditing their own repositories, CI pipelines and dependencies
  • Red teams assessing supply-chain and CI/CD exposure within agreed scope

Skip it if

  • Accessing or probing websites and code you do not own or have written permission to test, since the techniques describe exploiting exposed .git folders and leaked secrets
  • Beginners expecting a step-by-step tutorial: the file is a terse cheat sheet that assumes security background and only names tools rather than explaining how to run them

Try asking

  • “Check my staging site for an exposed .git folder and recover the deleted sensitive files from history”
  • “Scan this repository and its git history for hardcoded API keys and verify which ones are still live”
  • “Explain how to deobfuscate the app-service.js bundle in this UniApp project”
  • “Review our GitHub Actions workflows for command injection and self-hosted runner risks”
Step-by-step guide: how to use Source Code HuntingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    source-code-hunting.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip source-code-hunting.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip source-code-hunting.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only point the skill at code and sites you are authorised to test; the techniques are offensive and the agent will not verify permission for you.
  • Install the named tools first, since the skill references them but does not install them.
  • Ask for one area at a time (for example secrets scanning or CI review) to get more focused and verifiable results.

What's inside

  • SKILL.md

Redistributed unmodified from AIPentest/CyberStrikeAI under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.