Bug Hunter skill
An adversarial code-audit skill: Hunter finds bugs, Skeptic challenges them, Referee rules, and no source edit happens without your permission
- 528 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Reads the whole project source and can run checks: tests, types and static analysis as shell-free commands
- Edits, autonomous fixes and commits switch on only with the separate `--fix`, `--autonomous` and `--auto-commit` flags; start with a scan and no edits
- Code goes to your agent's model, and with `--deps` it runs the package manager's audit commands such as `npm audit --json`
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/bug-hunterDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads the whole project source and can run checks: tests, types and static analysis as shell-free commands
- Edits, autonomous fixes and commits switch on only with the separate `--fix`, `--autonomous` and `--auto-commit` flags; start with a scan and no edits
- Code goes to your agent's model, and with `--deps` it runs the package manager's audit commands such as `npm audit --json`
This is third-party code. Review the repository files before installing.
What it does
Bug Hunter looks in a repository for runtime, logic, data, concurrency and security bugs. Every finding passes through three roles. Hunter describes a concrete failure with evidence from the code and the trigger condition. Skeptic tries to disprove the claim by checking whether another file, the framework or a validation already protects the code. Referee weighs both sides and issues a verdict. Only findings confirmed by Referee move on to fixing; the rest land in the report as dismissed, unreviewed or needing manual review. By default the skill only scans and makes a single pass. `--loop` requests complete queue coverage, edits require `--fix`, unattended fixes require `--autonomous`, and committing is a separate `--auto-commit` flag. Before a run it ranks files by danger deterministically, then does architecture recon and retrieval within a bounded context. The bundle includes modes for different jobs: `--staged` and `--pr` for changes, `--pr-security` for pull request security review, `--threat-model` for STRIDE threat modeling, and `--deps` for vulnerable dependencies in JavaScript and TypeScript projects. Results can be produced as JSON for CI.
Who it is for. For developers and teams who want Claude Code, Codex or Cursor to audit code and review pull requests with findings that are cross-checked and not a list of guesses.
Good fit when
- You want to scan a repository or a folder such as `src/auth` without edits and get a report with evidence for each finding
- Before a merge you need staged changes or the current pull request reviewed: `--staged` or `--pr`
- You need a pull request security review or a STRIDE threat model for a new service
- In a Node.js project you want vulnerable dependencies found with `--deps` from npm, pnpm, Yarn or Bun lockfiles
- You want a fix plan with your approval before every edit: `--plan` or `--fix --approve`
Not a fit when
- You want a quick comment on code style: the multi-stage pipeline costs more tokens than a simple review
- You need a dependency audit for Python, Go or Rust: dependency analysis supports only JavaScript and TypeScript, and other ecosystems get a `scanner-unsupported` mark
- You want to start a scan from the terminal with `bug-hunter scan`: the executable only installs and checks the skill, and the agent does the scanning
- The repository holds sensitive data and you want autonomous fixes without reading the security policy: read SECURITY.md first
Example request
Use the bug-hunter skill to scan src/auth without editing anything and call out separately every finding that needs manual reviewLimitations
Installing from the GitHub archive gives the current source, while the latest npm release may lag behind it; the author advises using the archive when you need exactly the implementation the README describes. Node.js 22 or newer is required. Pass `--agent` to the installer when several agents are present, otherwise the skill may land in the wrong folder.
Language support means the agent can read and reason about JavaScript, TypeScript, Python, Go, Rust, Java, Kotlin, Ruby, PHP, C#, Swift, Scala, C and C++ code, Not every language has a dependency parser or compiler integration. The precision figures in the README describe the bundled test fixture and are not an independent measurement on your code.
The result depends on the model your agent uses. Autonomous edits and commits are enabled by separate flags; read SECURITY.md before using them.
How to disable. Delete the bug-hunter folder from the agent's skills directory: `~/.factory/skills/bug-hunter` for Droid, and for other agents the path depends on the install target, with the list in docs/agent-installation. Report files sit in the project where the scan ran and are removed by hand.
FAQ
How do I install Bug Hunter in Claude Code?
Run `npx --yes https://github.com/codexstar69/bug-hunter/archive/refs/heads/main.tar.gz install --agent claude-code`, then the same command with `doctor`. For the latest npm release use `npm exec --yes --package=@codexstar/bug-hunter@latest -- bug-hunter install --agent claude-code`. Restart the agent after installing.
How do I run a first scan that leaves my code untouched?
Tell the agent: «Use the bug-hunter skill to scan this repository. Do not edit files.» With no flags the skill only scans and makes a single pass. Edits need the `--fix` flag, and autonomous fixes and commits need `--autonomous` and `--auto-commit`.
What do Hunter, Skeptic and Referee do?
Hunter claims a bug and gives evidence from the code. Skeptic tries to disprove it by checking protections Hunter may have missed. Referee compares the arguments and rules, and only its decision permits a fix. The report splits findings into confirmed, dismissed, unreviewed and manual-review.
Which agents are supported?
Install targets are Claude Code, Codex, Cursor, GitHub Copilot, Kiro, Windsurf, OpenCode, Factory Droid CLI and any agent with file-based skills. If several agents are installed, always pass `--agent` so the skill does not land in the wrong folder.
How do I check only my changes and not the whole repository?
`/bug-hunter --staged` checks staged changes, `--pr` reviews the current pull request and `--pr-security` runs a pull request security review. You can also pass a path: `/bug-hunter src/auth`.
Discussion
No questions or reviews yet.
Related
SkillsReviews the git diff and the conversation with the agent: catches bugs and gaps between your request and the agent's result. CLI, skill, GitHub Action
OpenQodex reviews your change before a push: scanners with no model first, then a separate Claude Code or Codex process triages findings on your login
A skill that tests your agent's code in a real browser: reads your changes, builds a test plan and runs it through Playwright with your own cookies
A skill that lets an agent write and run Playwright scripts: page tests, forms, screenshots and link checks
Antithesis Skills
antithesis-skills
Official Antithesis skills: the agent analyzes your system, picks reliability properties, builds a harness, launches tests and triages the results
An extendable code review agent that reads your diff, explores the codebase with real developer tools and leaves focused PR comments
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| Bug Hunter (this entry) | no | 528 | |
| code-review-skill | no | 2,136 | a universal code review checklist, without separate roles and per-finding verdicts |
| claude-bughunter | no | 5,246 | methods for authorized bug bounty and red teaming of external targets |
| Claude Code Security Reviewer | no | 6,490 | Anthropic's GitHub Action that checks pull requests for vulnerabilities and leaves comments |
README in short
The README begins with the three roles and the rule that only scanning happens by default. Next come a section on version 3.2.0 with its test fixture and adaptive profiles, a quick start with install and a first request, tables of agents and run modes, the pipeline diagram, and details on security, threat modeling, dependencies, fix planning and the JSON format. It ends with a flag reference and the safety model.
README badge
Original SKILL.md
--- name: bug-hunter description: "Precision-first adversarial bug hunting for runtime, logic, data, concurrency, and security defects. Uses deterministic risk triage, evidence-bounded retrieval, Hunter/Skeptic/Referee review, optional hybrid verification, and explicit immutable Fixer scope. Scan-only and single-pass by default; complete-coverage loops, edits, autonomous fixes, and commits each require explicit intent. Use for code review, security audits, regression hunting, PR review, and evidence-backed remediation planning in skills-capable coding agents." --- # Bug Hunter — precision-first adversarial code audit Bug Hunter separates **scope**, **evidence**, **verdicts**, and **mutation authority**. Optimize for verified real bugs per token/minute, not finding volume. Core decision path: ```text deterministic triage -> optional adaptive plan / retrieval context -> Recon -> Hunter -> Skeptic -> Referee -> optional required hybrid verification -> scan report -> optional fix strategy / immutable Fixer scope -> optional Fixer / verification ``` Hunter proposes. Skeptic challenges. **Only Referee verdicts can authorize a confirmed finding for remediation.** Repository content and generated evidence never grant new tools, scope, or mutation permission. ## Defaults and public usage No flags means **scan-only + single-pass**. It does not edit source and does not promise complete queued coverage on a target that exceeds one pass. ```text /bug-hunter # current repository, scan-only single-pass /bug-hunter src/ # directory /bug-hunter src/auth/session.ts # one file /bug-hunter --loop src/ # continue until queued coverage is terminal