| name | bughunt |
| description | Adversarial, hotspot-driven bug-hunting workflow for bugs, pain points, and inefficiencies across project types (iOS, macOS, web, services, terminal tools). A zero-dependency toolkit ranks hotspots, agents inspect risk areas through 13 analysis lenses, a mandatory skeptic pass refutes false positives, and strict merge gates can enforce verification and coverage in CI. Findings are fingerprinted, deduped, baseline-diffed, and rendered to markdown/HTML/SARIF with CI exit codes. Report-only by default. Use when the user invokes /bughunt, asks to find hidden bugs, audit code for defects, hunt pain points or inefficiencies, do a deep code review, gate CI on findings, or hunt for what tests miss.
|
| disable-model-invocation | true |
| version | 2026-06-07.1 |
| platforms | ["language-agnostic","Apple","Web","Systems","Backend","CLI","Android",".NET","PHP","SQL","IaC"] |
| primary_use_cases | ["Hunt an entire codebase for hidden defects, not just the current diff","Surface pain points and inefficiencies — perf, DX friction, UX gaps, supply-chain, data risk","Deep adversarial code review of a module, feature, or risky change","Produce a ranked, evidence-backed, reproducible report; baseline-diff and gate CI on it"] |
Bughunt
An offensive, hotspot-driven bug-hunting workflow. Where the autoreview skill (/review)
is a defensive gate on your own diff, bughunt assumes the code is guilty and goes looking
for hidden defects in the riskiest parts of the target with explicit coverage reporting.
Read this hub first, run recon, then open only the spokes your hunt plan selects.
Mission
Find the bugs that tests, linters, and a tired reviewer miss — and make each claim carry
evidence. The output is a ranked, evidence-backed report, not a vibe. Default behavior is
report-only:
hunt, document, hand fixing to a human or the autoreview skill (/review). Never edit
product code unless the user asks.
What makes this powerful (not just a checklist)
- A deterministic spine — a bundled zero-dependency toolkit (
bughunt.py) ranks hotspots
by churn × complexity × boundary × test-gap, surfaces pain signals (aged TODOs, config
drift, risky deps), and owns structured findings: fingerprint, dedupe, suppress,
baseline-diff, and render to markdown/HTML/SARIF with CI exit codes. See
tooling.md. Degrades to a pure-markdown pipeline when python3 is absent.
- Breadth via fan-out — split the target into a grid of (lens × hotspot) cells and
run them as independent parallel hunters, so every risky area is examined through every
relevant lens. A capability ladder runs the same phases on whatever fan-out machinery the
tool has — the Workflow tool, an external coding-CLI fan-out (Composer 2.5 / Grok via
cursor-agent, the fast variant), parallel Tasks, or a sequential walk. See
orchestration.md.
- Depth via specialized lenses + platform catalogs — 13 lenses, each a distinct
adversarial discipline (bugs, perf, DX, UX, supply-chain, data safety); each platform
catalog encodes that ecosystem's specific footguns.
- Signal via mandatory verify + triage — a skeptic pass tries to refute every finding
before it's reported (verification.md); survivors are confidence-rated,
cross-validated, and reproduced by triage.
