SkillPublic
fix-class-sweep
After fixing one instance, search served code and source for every sibling of the same bug class, including bypass variants, and fix or list each one. Use for every fix of a security, validation, access, idempotency, rendering, or error-handling bug.
68
Quality
86%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Securityby
Passed
No findings from the security scan
Class Sweep
| Class | Search | Bypass variants to prove |
|---|---|---|
| Open redirect | redirect(, location =, next, return_url | https://evil, //evil, /\evil, %2F%2Fevil, javascript: |
| Ownership (IDOR) | every lookup by params.id/query.id; search; exports; report pages | ID swap in URL, body, GraphQL, both directions |
| XSS | innerHTML, dangerouslySetInnerHTML, v-html, raw template output | HTML, attribute, and URL contexts |
| SSRF | server-side fetch of stored or user URLs | 127.1, 0x7f000001, 2130706433, [::1], 169.254.169.254, DNS names resolving private |
| Idempotency | webhooks and POSTs that grant, charge, or email | replay, reorder, concurrent |
| Client trust | price, role, paid, or owner from the request | forged fields |
| Sensitive fields | every serializer, including create and duplicate responses | other users' emails, paid text, tokens |
| Swallowed errors | catch {}, missing res.ok, continue-on-fail | 404/500 paths |
Procedure
- Run every search for the class; list hits with file:line.
- Fix each with the shared helper, or list it with a reason.
- Run the Fixer guards (
tools/guards.pyor its ESLint/semgrep port); zero new hits.
Exit criteria
A sweep report (searches, hits, fixed, listed with reasons) and a clean guard run.
Counterpart of tester skill: qa-static-scan.
- Repository
itsablabla/qa-bug-agent-skills
- Revision
9a6f628
- Last updated
- First committed
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.