Source: getsentry/skills · Maintainer: community: Sentry · License: Apache-2.0 · Checked: 24 October 2026
What is the find-bugs skill?
find-bugs is a Sentry-written Agent Skill that makes Claude Code, Codex or another coding agent review the changes on your current branch for security vulnerabilities, bugs and code quality problems, then report what it found without touching the code. It suits a last check before you open a pull request.
It lives in getsentry/skills, which the README describes as "Agent skills for Sentry employees, following the Agent Skills open format." The skill's description reads: "Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch."
On its skills.sh page, find-bugs had about 6,900 installs (snapshot, 24 October 2026), the fourth most installed skill in the repo. Its sibling code-simplifier cleans code up; find-bugs looks for what is wrong with it.
What does it do?
The whole skill is one SKILL.md of about 2,800 bytes. It walks the agent through five phases and a fixed report format.
Phase 1: gather the complete input. The agent gets the full diff against your default branch with this command:
git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD
The inner gh repo view call asks GitHub for the repo's default branch name, so you need the GitHub CLI installed and signed in. If the diff output is truncated, the agent must read each changed file until it has seen every changed line, then list every modified file before moving on.
Phase 2: map the attack surface. For each changed file it lists user inputs, database queries, authentication and authorization checks, session and state operations, external calls and cryptographic operations.
Phase 3: run the security checklist on every file. The 11 items are injection (SQL, command, template, header), XSS, authentication, authorization and IDOR, CSRF, race conditions (TOCTOU in read-then-write code), session handling, cryptography, information disclosure, denial of service, and business logic such as edge cases and numeric overflow.
Phase 4: verify. For each candidate issue, the agent checks whether the changed code already handles it elsewhere, searches for tests that cover it, and reads the surrounding context to confirm it is real.
Phase 5: audit itself before concluding. It must list every file it reviewed and confirm it read each one completely, state the result for every checklist item, and name anything it could not fully verify. Only then does it write findings.
The report puts security vulnerabilities first, then bugs, then code quality, and skips style and formatting. Each issue gets a file and line, a severity from Critical to Low, the problem, the evidence, a concrete fix and any standards references such as OWASP. Two lines set the tone: "If you find nothing significant, say so - don't invent issues." and "Do not make changes - just report findings. I'll decide what to address."
How does it compare with other review options?
Claude Code ships its own review commands, and Sentry's repo has two other review skills. The Claude Code commands reference describes /security-review as analyzing "the changes on your current branch for security vulnerabilities" and /code-review as a review of the current diff for correctness bugs.
| find-bugs | Sentry security-review |
Claude Code /security-review |
Claude Code /code-review |
|
|---|---|---|---|---|
| What it covers | Security, bugs, quality | Security only, high-confidence findings | Security only | Correctness bugs, plus cleanup at some effort levels |
| What it reviews | Branch diff: default branch from gh, then git diff |
The file, diff or code you give it, researching the whole codebase | Diff against origin's default branch | Current diff, or a PR, branch or path |
| Output | Report only, told not to edit | Findings with a remediation for each | Findings | Findings; applies them with --fix |
| Install | Skill (folder) | Skill (folder) | Built in | Built in (bundled skill) |
| skills.sh audits | All Pass | Fail from two auditors | Not listed | Not listed |
Sentry's code-review skill is a third option, described as performing "code reviews following Sentry engineering practices." find-bugs is the lightest of the skills: one file, no references and a checklist you can read in a minute.
How do you install the find-bugs skill?
Just this skill. The command shown on skills.sh uses the skills CLI:
npx skills add https://github.com/getsentry/skills --skill find-bugs
Skills install to the current project by default; add -g to make them available across projects, or -a claude-code to pick Claude Code directly. In Claude Code the folder ends up in .claude/skills/find-bugs/ for one project or ~/.claude/skills/find-bugs/ for all of them, the standard Claude Code skill locations.
The whole Sentry collection in Claude Code. From the getsentry/skills README:
claude plugin marketplace add getsentry/skills
claude plugin install sentry-skills@sentry-skills
The README says to restart Claude Code afterward and that "Skills activate automatically when relevant." Plugin skills are namespaced as /plugin-name:skill-name, so this one becomes /sentry-skills:find-bugs. To update, the README gives claude plugin marketplace update followed by claude plugin update sentry-skills@sentry-skills.
Other agents. The README says npx skills add getsentry/skills works with Claude Code, Cursor, Cline, GitHub Copilot and other compatible agents. Codex and Cursor read the same SKILL.md format; see Codex skills and Cursor skills.
How do you use it?
Commit your work, check out the feature branch, and ask for a review. The description is broad, so phrases like "find bugs", "security review" or "audit this branch" can load it without a slash command.
Example prompts (suggestions, not quotes from the repo):
/find-bugson its own, from a feature branch with committed changes.Find bugs in this branch before I open the PR. Report only, don't fix anything.Security review the changes on this branch, focusing on the new upload endpoint.Audit this branch and list anything Critical or High first, with OWASP references.Fix the two High findings from your review and leave the rest.(a follow-up once you have the report)
Requirements: git, the GitHub CLI signed in to the repo's host, and a repo with a GitHub remote so gh repo view can resolve the default branch. There are no packages, scripts or API keys.
Tips and limits
From the files and pages linked, not from testing:
- Security audits. As of 24 October 2026, skills.sh showed Pass from Gen Agent Trust Hub (risk level SAFE), Socket and Snyk (risk level LOW), all audited 14 September 2026. Gen Agent Trust Hub tagged it for command execution and indirect prompt injection, because it runs
gitandghand reads code from the diff. - Committed changes only.
git diff <default>...HEADcompares commits, so uncommitted edits are not in the review unless you ask for them. - It uses your local copy of the default branch. The command passes the branch name, such as
main, notorigin/main. If your localmainis far behind, pull it first so the diff contains only your branch's work. - GitHub only, as written. The default branch lookup depends on
gh. On GitLab or a repo without a GitHub remote, tell the agent which branch to diff against. - It reads, it doesn't run. Verification means reading code and searching for tests. Nothing in the skill runs your test suite or a scanner, so pair it with your normal CI.
- Large branches cost context. The skill insists on reading every changed line and every changed file in full. On a big branch that is a lot of tokens; splitting the review by directory keeps it manageable.
- License. Apache-2.0 for the repo, with no separate license in this folder. You can copy and modify it if you keep the license notice.
Save it in your Kipt library
In Kipt, open Skills and paste the find-bugs folder link into the import box. For a repo with many skills, Kipt shows a list to pick from, so you can take code-simplifier in the same pass. You can also drop the folder or a .zip, which makes it easy to add your own checklist items, such as your framework's auth helpers, before saving. Your skills live in your own private GitHub repo and install into Claude Code or Codex with one command:
npx skills add https://github.com/<you>/<repo>.git --all -g
Kipt is not affiliated with Sentry.
Similar skills
- Sentry skill: code-simplifier from the same repo, for cleanup after the bugs are fixed.
- Code review skill: a broader structured review of a change.
- Differential review skill: Trail of Bits' security-focused review of a diff.
- Security and hardening skill: secure defaults to apply while you build, before review.
- Claude Code review: the built-in review commands and options compared.