AI agent that finds security bugs

Vuln Scanner is an aeon skill: Audit trending repos for real security vulnerabilities and disclose responsibly - scan and route findings (PVR / dependency PR), re-submit queued advisories, and send armed email disclosures. Like every aeon skill it is one SKILL.md prompt file that runs unattended on your own GitHub Actions, on a schedule or when you trigger it, and sends what it finds to Telegram, Discord, Slack or email.

This is the write / action arm of the vuln-disclosure loop - one skill covering the full responsible-disclosure lifecycle:

Every aeon skill takes one optional text input, var, set in aeon.yml or typed in when you run it by hand. It picks the target or the mode for that run.

Action selector, shaped [<action>][:<owner/repo>]. Empty or a bare owner/repo → scan arm (audit that repo, or auto-select a trending one). resubmit / resubmit:owner/repo → re-submit arm (probe the security watchlist for repos that just enabled PVR and submit any queued advisory). disclose / email → disclose arm (queue armed out-of-band email disclosures for sending). Examples:

• `` → scan, auto-select from trending
• openai/whisper → scan openai/whisper
• resubmit → probe the whole watchlist and re-submit what flipped
• resubmit:vercel/next.js → probe just that repo (one-off)
• disclose (alias email) → arm & queue eligible disclosure emails
• poc-smoke → exercise the PoC gate against a benign real Base fork (no audit or disclosure)
• riva:owner/repo → scan with the Riva research kernel (shadow/proposal only)

Besides the model you connected to aeon, Vuln Scanner uses the following. Add secrets as GitHub Actions secrets on your aeon repo, or in Aeon Connect.

• GH_GLOBAL - optional secret, unlocks more data or features
• RESEND_API_KEY - optional secret, unlocks more data or features
• RESEND_FROM - optional secret, unlocks more data or features
• RESEND_REPLY_TO - optional secret, unlocks more data or features

Easiest: open Aeon Connect, sign in with GitHub and turn on Vuln Scanner. No clone, no terminal. To add it to an existing aeon repo from a shell, run:

Then switch it on in aeon.yml (the default schedule is filled in):

skills:
  vuln-scanner: { enabled: true, schedule: "0 16 * * 6", var: "" }

New to aeon? Read the docs for how skills, schedules and memory fit together, or browse all skills.