القائمة
Generates a project-specific /find-bugs skill with stack-specific security and correctness checklists. Run once per project. Usage: /generate-find-bugs
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Read-only bug audit of the current branch vs a base ref. Dispatches subagents per stack (Go, JS/TS, etc.), consolidates findings, produces a prioritized report. Does not fix. Usage: /find-bugs [base-ref]
Multi-model PR review with parallel fan-out. Three Ollama models (Cloud `:cloud` by default, local fallback) review the full PR diff in parallel; Claude acts as Arbiter, using vote count as a confidence prior to confirm/escalate/dismiss findings, then applies a single consolidated fix commit. Auto-merges (squash) when no fixes were reverted and the PR is mergeable; otherwise leaves it for manual review. Usage: /fix-review [PR-number]
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.
Self-learning system — log mistakes/wins, run retrospectives, promote patterns to hard rules, and coach on workflow quality. Usage: /self-learn [log|retro|status|init|tips]
session-indexer ship pipeline: issue → implement → review → merge → close. Usage: /ship [--yes|-y] [issue-number | title]
Systematic bug diagnosis — reproduce, isolate, hypothesize, verify, fix. Usage: /debug [what's broken]
| name | generate-find-bugs |
| description | Generates a project-specific /find-bugs skill with stack-specific security and correctness checklists. Run once per project. Usage: /generate-find-bugs |
Detects the project's tech stack and appends language-specific security and correctness
checklists to the generic /find-bugs skill.
ls package.json go.mod requirements.txt Cargo.toml 2>/dev/null | head -5
cat CLAUDE.md 2>/dev/null | head -80
grep -rn "TODO\|FIXME\|HACK\|unsafe" . \
--include="*.go" --include="*.ts" --include="*.tsx" \
--exclude-dir=node_modules --exclude-dir=.git \
2>/dev/null | head -15
Write to .claude/skills/find-bugs/SKILL.md.
Keep Phases 1–5 and the output format intact. Add a Stack-Specific Checklists section after Phase 3, tailored to detected stack:
Go:
### Go Checklist
- [ ] Goroutine leaks — all goroutines bounded by context or timeout?
- [ ] Nil interface vs nil pointer — returning interface wrapping nil concrete?
- [ ] Context propagation — request contexts passed to all blocking operations?
- [ ] Mutex scope — mutex unlocked in the same scope it was locked?
- [ ] SSE headers — WriteHeader called exactly once, before any body writes?
- [ ] Request size limits — applied before decoding JSON from untrusted input?
- [ ] Response body close — deferred after nil check?
React/TypeScript:
### React / TypeScript Checklist
- [ ] Stale closures — useEffect captures variables that change? All in deps array?
- [ ] Unmount safety — async callbacks check if component still mounted before setState?
- [ ] Missing key props — every .map() rendering JSX has unique stable key?
- [ ] Direct state mutation — objects/arrays mutated in place instead of new refs?
- [ ] XSS via dangerouslySetInnerHTML — LLM or user content injected unsanitized?
- [ ] CORS bypass — origin validated by exact match, not prefix/substring?
Node/Express:
### Node / Express Checklist
- [ ] Dynamic code execution — user-supplied strings reaching code evaluation APIs?
- [ ] Path traversal — file paths built from user input without resolve + prefix check?
- [ ] Prototype pollution — parsed JSON merged into objects without sanitization?
- [ ] ReDoS — regex applied to user input that could catastrophically backtrack?
Also add project-specific attack surface items from Steps 2–3.
.claude/skills/find-bugs/SKILL.md — overwrite generic.