Back to directory

Bug Hunter

An adversarial code-review skill for AI coding agents in which one role finds possible bugs, a second challenges each claim, and a third decides what the evidence supports, defaulting to a scan-only, single-pass report.

Bug Hunter

Bug Hunter runs a three-role pipeline, a Hunter, a Skeptic and a Referee, to find security vulnerabilities, logic errors and runtime bugs and decide which findings the evidence actually supports. By default it only scans and reports; editing, autonomous fixing and commits each require explicit permission, and looped coverage or mutation testing must be requested explicitly.

Its v3.2.0 source adds a benchmark quality gate that scores one-to-one finding matches, precision, recall, severity-weighted recall, false positives per thousand lines, calibration, repeat stability, token usage, latency and cost; adaptive execution profiles that choose a fast, balanced or assurance mode from risk and evidence; and hybrid verification that runs tests, type checks, static and fuzz checks, failing closed when required verification is unavailable.

It caches evidence only when source, protocol, role and configuration match exactly, and rejects source drift instead of reusing stale conclusions. It supports Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI, OpenCode and Pi Coding Agent.

More in Agent skills

See all 581
  • Provenance gate

    github.com

    A deterministic authorization gateway that sits between an AI agent and its tools, tracing where each parameter of a side-effect call came from, and blocking the call or asking a human when the source does not check out.

  • A markdown framework of system rules that restates Isaac Asimov's Four Laws of Robotics as a set of prioritized loss calculations for large-language-model agents to follow, published as a discovery file for agents and crawlers to read.

  • Vitruvius

    github.com

    An engineering research agent that runs a discover, read, synthesize, verify and review loop over technical questions, reading sources directly rather than inferring from titles, and publishing its own scored verifier benchmark, weaknesses included.