How to use the Bug Identification Methodology agent skill

What does the skill make the agent do?

The skill loads a methodology document into the agent's working context. When a conversation involves topics such as code review, taint analysis, static analysis, code audit or bug hunting, the agent applies the checklist to the target in front of it. It follows the phases in order unless you say otherwise, considers which techniques fit your context, tracks which checklist items are complete and suggests next steps based on what it finds.

The skill is a methodology and reference, not a scanner. It does not run scans or tools itself. The phases cover reconnaissance, static analysis, dynamic analysis, fuzzing and exploitation, and the attack-surface notes include Windows user mode, kernel drivers and eBPF. The exploitation phases go beyond finding bugs.

• Phase 1: Reconnaissance (target enumeration, attack surface mapping, documentation review, prior art)
• Phase 2: Static analysis (source review, binary analysis, patch diffing, SBOM analysis)
• Phase 3: Dynamic analysis (behavioural analysis, debugging, instrumentation, taint analysis)
• Phase 4: Fuzzing (corpus generation, harness development, coverage monitoring, crash triage)
• Phase 5: Exploitation (primitive development, mitigation bypass, payload development, weaponization if authorised)

How do you install the skill?

Download the ZIP of the offensive-bug-identification skill from this page. The skill ships as a single file, SKILL.md. Unzip it so the offensive-bug-identification folder sits in one of these locations: ~/.claude/skills/ for your personal skills, or .claude/skills/ inside a project folder if you want the skill limited to that project.

You can also upload the skill through the Claude apps. Open Settings, go to Capabilities, then use the Skills section to add it.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ in your project
• Claude apps: Settings → Capabilities → Skills, then upload

How do you trigger the skill with natural requests?

You do not need a special command. The skill activates when your request involves one of its trigger phrases: bug identification, code review, taint analysis, dangerous functions, data flow, source audit, black box, vulnerability identification, static analysis, code audit or bug hunting. Describe the task in plain language and name the target and your authorisation context.

Once active, ask the agent to track progress and recommend the next step. The skill tells the agent to track completed checklist items, so you can ask where the review stands.

• "Use the bug identification checklist to do a source audit of this parser module. I own this code."
• "Run a code review of this upload handler and focus on taint analysis from user input to file writes."
• "We are in scope for this bug bounty program. Walk me through static analysis of the API client, then tell me what to check next."
• "Which checklist items are still open for this audit?"

What are typical examples of use?

The methodology is most useful when you already have a target and want a systematic review rather than ad hoc poking. Because it lists the places to look, it helps you avoid skipping whole categories such as input parsing, IPC or driver interfaces.

For a developer, the skill can work as a structured review checklist for your own application. For a security team, it can help define the stages of a vulnerability identification workflow. For a researcher on an authorised target, it provides a reminder of attack surfaces such as Windows shared memory, RPC and named pipes, or the IOCTL interface of kernel drivers.

• Reviewing your own web service for dangerous functions and unvalidated input
• Mapping the attack surface of a Windows user-mode service (shared memory, RPC, named pipes)
• Triage of a third-party kernel driver's IOCTL handlers
• Planning fuzzing work: corpus, harness, coverage and crash triage
• Designing a team workflow for vulnerability identification

What do you need before you start?

The skill lists no specific requirements. It runs no scripts and makes no network calls. Its only file is SKILL.md, so it is a set of instructions for the agent rather than software you have to install alongside it.

The methodology does assume you have the target and the expertise to act on it. Source code, binaries, documentation and a test environment will determine which phases apply. Use it only on systems you own or are authorised to test.

What safety points should you know?

The skill contains no scripts and uses no network access, so installing it does not run code on your machine. The risk lies in how the content is used. The methodology includes exploitation and weaponisation phases, which could be misused against systems you do not own or have written permission to test.

Keep the authorisation context explicit in your requests. Limit exploitation work to phases you are permitted to carry out, and keep testing inside the scope of your engagement or bug bounty rules.

• Attacking systems without permission is not covered by this skill's purpose; confirm scope first
• Ask for the review phases you need rather than the whole chain if you only need to find bugs
• The skill does not run scanners, so you still need your own tools for execution and testing

What tips will improve the results?

Give the agent concrete material. Paste the relevant source, name the component and say what the input sources are. The skill asks the agent to consider applicability to your context, so a specific target gives better answers than a general topic.

Work through the phases in order and let the agent record what is finished. Revisit the list after each finding, because the skill asks the agent to suggest next steps based on results.

• State the scope and your authorisation at the start of the conversation
• Name the language, platform and component under review
• Ask for one phase at a time when the target is large
• Use the open-items question to resume a review in a later session