Run any Skill in Manus with one click

Get Started

debugging

Stars0

Forks0

UpdatedMay 24, 2026 at 19:36

Deep static analysis and bug hunting for any codebase.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

lancejames221b

lancejames221b/stark-skills

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

7 files

SKILL.md

readonly

name	debugging
description	Deep static analysis and bug hunting for any codebase.
category	debugging
runtimes	["claude"]
pii_safe	true

Bug Hunt Agent

Purpose

Deep static analysis and bug hunting for any codebase. Finds real bugs, not just pattern matches.

Operating Mode

When invoked, scan the entire codebase systematically. Run as a single agent session.

Method

Phase 1: Reconnaissance (30s)

Read package.json / go.mod / Cargo.toml to identify the stack
Find entry points: server/index.ts, main.go, src/App.tsx, etc.
Read the root config files (tsconfig, vite, docker, etc.)
Map the directory structure at top level

Phase 2: Static Analysis — Read Every File

Go file-by-file through source code. For each file check:

Type Safety:

Missing await on async calls
Type coercion (string vs number, implicit any)
Unused imports/variables
Missing as casts that hide type errors

Logic Errors:

Wrong state transitions (e.g., allowing paid → claimed)
Off-by-one errors in loops/ranges
Missing null checks before property access
Race conditions (reading then writing without locking)
Stale closures in event handlers / useEffect / setTimeout

Security:

Hardcoded secrets / API keys / passwords
Missing auth checks on routes that should have them
SQL injection via string concatenation (not parameterized)
Unvalidated user input reaching DB/query layer
eval(), new Function(), template literals with user data

Error Handling:

Empty catch blocks
Swallowed errors (catch then nothing)
Missing error handling on async functions
500 responses that expose stack traces in production

Resource Management:

Memory leaks (unclosed connections, missing cleanup)
File descriptors not closed
Unbounded arrays/collections growing forever

Phase 3: Cross-Reference Checks

Every API route → check: auth guard? input validation? error handling?
Every DB query → check: field names match schema? proper types?
Every event/callback → check: handler exists? cleanup on unmount?
Every config/env var → check: fallbacks? defaults?

Phase 4: Runtime Testing

Start the server
Hit every endpoint with curl
Test auth enforcement (unauthorized access)
Test edge cases (empty bodies, wrong types)
Check error responses are clean (no stack traces)

Phase 5: Report

Output a structured report:

## Bug Hunt Report

### 🐛 Bugs (must fix)
- **File:Line** — Description
  Cause: ...
  Fix: ...

### ⚠️ Warnings (should fix)
- ...

### ℹ️ Info (ok)
- ...

### Score: X/10

Priority

BUG > WARNING > INFO. Only report things that are actually wrong, not style preferences.

Scope

Scan the entire project, not just "new" files
Check existing code for bugs too
Focus on runtime-breaking issues first
Then security issues
Then correctness edge cases
Then minor improvements

More from this repository

same repository

checkpoint

lancejames221b/stark-skills

Mark a logical phase completion in haivemind. More formal than /snapshot — used at step/phase boundaries in multi-phase work. Creates a named, resumable point that /continue can restore from. Triggered by /checkpoint, "checkpoint this", "mark this as a checkpoint", or at phase boundaries in long-running tasks.

2026-05-310

qwen-do

lancejames221b/stark-skills

Run the Qwen Code CLI as a one-shot bounded executor in a plan/do/verify loop. A frontier model (or you) plans the next bounded step and verifies the result; qwen-do makes a local model do exactly that one step, smoke-test first, then stop. Use when you want a cheap local model to do grunt coding while a smarter orchestrator keeps it on rails.

2026-05-300

git-pii-guard

lancejames221b/stark-skills

Scan git commits for PII, credentials, API keys, and passwords before they are pushed. Automatically gates commits via a pre-commit hook. Use when installing PII scanning on a repo, manually scanning a file or diff for credentials, or when a commit is blocked by the hook and remediation is needed. Triggers on "scan for PII", "check for credentials", "install PII guard", "pii hook", or when a commit is blocked by a PII check.

2026-05-240

content-quality-auditor

lancejames221b/stark-skills

Runs a full CORE-EEAT 80-item content quality audit, scoring content across 8 dimensions with weighted scoring by content type. Produces a detailed report with per-item scores, dimension analysis, and a prioritized action plan.

2026-05-240

diagnose

lancejames221b/stark-skills

Deep analysis and debugging with Opus. Systematically investigate problems, identify root causes, and recommend fixes with evidence.

2026-05-240

pr-review

lancejames221b/stark-skills

PR review skill. Two modes: /pr [link] = internal thoughts only, what to look for, what to test — NO GitHub action ever. /pr-comment [link] "make it so #1" = draft a GitHub PR comment in <USER_NAME>s voice, present for approval, post only on explicit "go". Passphrase + "go" are both required before any GitHub write. Without both gates, nothing leaves the building.

2026-05-240

name	debugging
description	Deep static analysis and bug hunting for any codebase.
category	debugging
runtimes	["claude"]
pii_safe	true

Bug Hunt Agent

Purpose

Deep static analysis and bug hunting for any codebase. Finds real bugs, not just pattern matches.

Operating Mode

When invoked, scan the entire codebase systematically. Run as a single agent session.

Method

Phase 1: Reconnaissance (30s)

Read package.json / go.mod / Cargo.toml to identify the stack
Find entry points: server/index.ts, main.go, src/App.tsx, etc.
Read the root config files (tsconfig, vite, docker, etc.)
Map the directory structure at top level

Phase 2: Static Analysis — Read Every File

Go file-by-file through source code. For each file check:

Type Safety:

Missing await on async calls
Type coercion (string vs number, implicit any)
Unused imports/variables
Missing as casts that hide type errors

Logic Errors:

Wrong state transitions (e.g., allowing paid → claimed)
Off-by-one errors in loops/ranges
Missing null checks before property access
Race conditions (reading then writing without locking)
Stale closures in event handlers / useEffect / setTimeout

Security:

Hardcoded secrets / API keys / passwords
Missing auth checks on routes that should have them
SQL injection via string concatenation (not parameterized)
Unvalidated user input reaching DB/query layer
eval(), new Function(), template literals with user data

Error Handling:

Empty catch blocks
Swallowed errors (catch then nothing)
Missing error handling on async functions
500 responses that expose stack traces in production

Resource Management:

Memory leaks (unclosed connections, missing cleanup)
File descriptors not closed
Unbounded arrays/collections growing forever

Phase 3: Cross-Reference Checks

Every API route → check: auth guard? input validation? error handling?
Every DB query → check: field names match schema? proper types?
Every event/callback → check: handler exists? cleanup on unmount?
Every config/env var → check: fallbacks? defaults?

Phase 4: Runtime Testing

Start the server
Hit every endpoint with curl
Test auth enforcement (unauthorized access)
Test edge cases (empty bodies, wrong types)
Check error responses are clean (no stack traces)

Phase 5: Report

Output a structured report:

## Bug Hunt Report

### 🐛 Bugs (must fix)
- **File:Line** — Description
  Cause: ...
  Fix: ...

### ⚠️ Warnings (should fix)
- ...

### ℹ️ Info (ok)
- ...

### Score: X/10

Priority

BUG > WARNING > INFO. Only report things that are actually wrong, not style preferences.

Scope

Scan the entire project, not just "new" files
Check existing code for bugs too
Focus on runtime-breaking issues first
Then security issues
Then correctness edge cases
Then minor improvements