bug-hunter

Systematic bug hunting and vulnerability detection workflow. Use when the user asks to find bugs, analyze code for issues, debug problems, or perform security audits.

Jump to install

Repository: hedypamungkas/koboi-agent
Last source activity: June 22, 2026 at 17:55
Detected SKILL.md language: English
Stars: 5
Forks: 0

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hedypamungkas/koboi-agent --skill bug-hunter

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

issue-triage-batch-fix

This skill should be used when the user asks to "check the GitHub issues", "triage the open issues", "assess and rank the issues", "what issues should we fix", "fix the top issues", or otherwise wants to go from the issue tracker to fixed, merged PRs. It runs the whole loop end-to-end without further prompting — verify each issue empirically against current code, rank by severity × effort, surface the top high/critical ones (TDD is the default method, not an option), and once the user confirms scope, automatically dispatch the fixes in parallel as isolated worktree workers, each shipping its own PR, plus a reproducible harness, CI verification, and a memory note.

2026-07-17

koboi-release

This skill should be used when the user asks to "release koboi-agent", "bump version and publish", "create a new release", "push to PyPI", "tag and release", "ship version vX.Y.Z", or mentions PyPI publishing, GitHub releases, or GHCR container image publishing for the koboi-agent project. Encodes the full release sequence (merge → pre-check → bump → tag → PyPI + GHCR auto-publish → verify → GitHub release) plus the gotchas learned from releases v0.3.0–v0.4.3.

2026-07-13

docs-align

This skill should be used when the user asks to "align docs", "sync documentation", "update README", "update CLAUDE.md", "fix stale docs", "audit documentation", "ensure docs match code", or mentions any discrepancy between documentation files (README, CLAUDE.md, architecture.md, configs/CLAUDE.md, folder CLAUDE.mds, etc.) and the actual codebase. Spawns parallel exploration agents to map the code + audit every doc, then revises all stale documentation to match — compact, jargon-free, human-and-LLM-friendly. Gates new-doc creation via AskUserQuestion.

2026-07-05

View all from this repository

name	bug-hunter
description	Systematic bug hunting and vulnerability detection workflow. Use when the user asks to find bugs, analyze code for issues, debug problems, or perform security audits.
allowed-tools	search filesystem

Bug Hunter Skill

Specialized bug-hunting patterns and investigation strategies for Python code.

Bug Signature Patterns (Quick Reference)

Pattern	grep regex	Typical Severity
SQL injection	`f".SELECT.\{` or `f".INSERT.\{`	P0
Hardcoded secrets	`(password	secret
Unvalidated webhooks	`webhook.signature\|verify.webhook`	P0
Race conditions	`self\.\w+\[.\]\s=` without lock context	P1
Division by zero	`/\s\w+\s(?!\sif\s\w)`	P1
Missing cleanup	`open$.$\s$` without `with`	P1
Unclosed connections	`.(connect	post
Float currency	`\\s0\.\d+` in money context	P2
TTL unit mismatch	`(time	timestamp)\s[+].*1000`
Off-by-one	`range$.len\(.+$\s-\s*1`	P1
Swallowed exceptions	`except.:\s\n\s*pass`	P2
Missing validation	`(tier	region

Investigation Strategy

SCOPE -- Use glob_find to discover all relevant files in the directory
SCAN -- Use grep_search with the signature patterns above
READ -- Use read_file on flagged files for full context
TRACE -- Follow data flow from inputs to outputs
REPORT -- Use the structured output format from system prompt

Common False Positives to Avoid

String formatting with parameterized queries (? placeholders) is NOT SQL injection
time.sleep() in a lock context is valid; outside a lock suggests race conditions
Integer division (//) is intentional when floor behavior is needed
round() on intermediate values is fine; on final monetary amounts it loses precision
try/except Exception is valid when followed by logging; only flag empty pass
Constants like MERCHANT_API_KEY in module scope may be intentional config; flag only if clearly hardcoded secrets

bug-hunter

Source facts

Install options

Review the source files

More from this repository

More from this repository

Bug Hunter Skill

Bug Signature Patterns (Quick Reference)

Investigation Strategy

Common False Positives to Avoid

Bug Hunter Skill

Bug Signature Patterns (Quick Reference)

Investigation Strategy

Common False Positives to Avoid