vuln-scanner

82 / 100 · Low risk

Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.

By aeonfun/aeon (GitHub) · coding · 791 stars · scanned at commit 5981e1c

Audit trending repos for real security vulnerabilities and disclose responsibly - scan and route findings (PVR / dependency PR), re-submit queued advisories, and send armed email disclosures

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 60 places.

skills/vuln-scanner/SKILL.md, line 61echo "kernel=${VULN_RESEARCH_KERNEL:-legacy}"
skills/vuln-scanner/SKILL.md, line 84grep -oE '\[[^]]+/[^]]+\]$https?://[^)]+$|https?://github\.com/[^/ )]+/[^/ )]+' output/.chains/github-trending.md
skills/vuln-scanner/SKILL.md, line 91date -u -d '14 days ago' +%Y-%m-%d

Show 17 more

skills/vuln-scanner/SKILL.md, line 95gh api "search/repositories?q=created:><SINCE>&sort=stars&order=desc&per_page=25" \
skills/vuln-scanner/SKILL.md, line 113git clone --depth 200 --quiet "https://github.com/<REPO>.git"
skills/vuln-scanner/SKILL.md, line 117gh repo fork "<REPO>" --clone --default-branch-only -- --depth 200 --quiet
skills/vuln-scanner/SKILL.md, line 122cd <NAME>
skills/vuln-scanner/SKILL.md, line 143mkdir -p /tmp/vuln-scan /tmp/bin
skills/vuln-scanner/SKILL.md, line 150python3 -m pip install --quiet --disable-pip-version-check semgrep slither-analyzer
skills/vuln-scanner/SKILL.md, line 155semgrep --config=p/security-audit --config=p/owasp-top-ten --config=p/secrets \
skills/vuln-scanner/SKILL.md, line 167python3 -c 'import subprocess,sys; r=subprocess.run(sys.argv[2:], stdout=open(sys.argv[1], "wb"), stderr=subprocess.DEVNULL); print("rc=%d" % r.returncode)' /tm
skills/vuln-scanner/SKILL.md, line 173python3 -c 'import subprocess,sys; r=subprocess.run(sys.argv[2:], stdout=open(sys.argv[1], "wb"), stderr=subprocess.DEVNULL); print("rc=%d" % r.returncode)' /tm
skills/vuln-scanner/SKILL.md, line 179python3 -c 'import subprocess,sys; r=subprocess.run(sys.argv[2:], stdout=open(sys.argv[1], "wb"), stderr=subprocess.DEVNULL); print("rc=%d" % r.returncode)' /tm
skills/vuln-scanner/SKILL.md, line 183wc -c /tmp/vuln-scan/osv.json
skills/vuln-scanner/SKILL.md, line 187python3 -c 'import subprocess,sys; r=subprocess.run(sys.argv[2:], stdout=open(sys.argv[1], "wb"), stderr=subprocess.DEVNULL); print("rc=%d" % r.returncode)' /tm
skills/vuln-scanner/SKILL.md, line 196slither . --json /tmp/vuln-scan/slither.json --exclude-informational --exclude-low 2>/dev/null
skills/vuln-scanner/SKILL.md, line 201wc -c /tmp/vuln-scan/semgrep.json
skills/vuln-scanner/SKILL.md, line 245cargo fuzz list
skills/vuln-scanner/SKILL.md, line 249mkdir -p /tmp/vuln-scan/fuzz
skills/vuln-scanner/SKILL.md, line 253python3 - '<TARGET>' <<'PY'

and 40 more places

Downloads and installs other software

The author does not mention this.

Found in 4 places.

skills/vuln-scanner/SKILL.md, line 132only `python3 -m pip install …` is used, as a fallback for the Python tools (semgrep,
skills/vuln-scanner/SKILL.md, line 150python3 -m pip install --quiet --disable-pip-version-check semgrep slither-analyzer
skills/vuln-scanner/SKILL.md, line 410**Optional - codex-security as an extra source.** If `OPENAI_API_KEY` is present **and** `npx` is allow-listed and the CLI is staged, `npx @openai/codex-securit

Show 1 more

skills/vuln-scanner/SKILL.md, line 11741. **Install** - the binaries (`semgrep`, `trufflehog`, `osv-scanner`, `slither`) are **not pre-installed**. The workflow step `scripts/stage-vuln-scanner.sh` s

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'vuln-scanner' ] || [ -L ~/.agents/skills/'vuln-scanner' ]; then echo 'A skill folder named vuln-scanner already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/aeonfun/aeon' "$d" && git -C "$d" checkout --quiet '5981e1caa880e9bc186e1bf9f27c095b3ba9ef22' -- 'skills/vuln-scanner' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/vuln-scanner' ~/.agents/skills/'vuln-scanner' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'vuln-scanner' ~/.claude/skills/'vuln-scanner' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for aeonfun/aeon shows the score of its lowest-scoring skill.

SkillTrust badge for aeonfun/aeon

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/aeonfun/aeon.svg)](https://zalavijaysinh.github.io/skilltrust/repos/aeonfun/aeon/)

Score history

Date	Version	Score
2026-11-10	`5981e1c`	82
2026-11-08	`c910f9a`	82
2026-11-06	`504a21d`	82

Also found in

Identical copies of this skill exist at:

MiroShark/miroshark-aeon/skills/vuln-scanner
aeonfun/aeon-agent/skills/vuln-scanner