Phase 2 of the gebug Web3 audit workflow. Use when the user types /gebug-work, or asks to execute / continue / finish / run / ship a gebug audit, or asks to audit / pentest / hunt vulnerabilities / build PoCs / produce a bounty report against a target that has already gone through /gebug-brainstorm. Reads docs/gebug-audit/definition/{DEFINITION,CANDIDATES, SAFETY_PREFLIGHT,BOUNTY_MATRIX}.md, runs static analysis, fuzzing, parallel vuln-hunter agents, applies the validity gate, builds Foundry fork PoCs, and writes per-finding files plus the headline report. EVM-only: do not trigger on Solana, Move (Sui / Aptos), CosmWasm, Stellar Soroban, NEAR, ICP, or any non-EVM chain, and do not trigger on generic forge / cast / slither tutorial requests that have no DEFINITION.md to consume.
Phase 1 of the gebug Web3 audit workflow. Use when the user types /gebug-brainstorm or describes a smart contract bug bounty target they want to scope: a Cantina / Immunefi / Code4rena / Sherlock / Hats listing, a GitHub repo, a deployed Ethereum / BSC / Polygon / Arbitrum / Base / Optimism / Avalanche contract address, a DeFi protocol, vault, lending market, AMM, bridge, LST, LRT, restaking system, oracle integration, or governance system. Conducts a structured interview, acquires source code, runs light recon, and writes DEFINITION.md and CANDIDATES.md so the user can run /gebug-work next. EVM-only: do not trigger on Solana, Move (Sui / Aptos), CosmWasm, Stellar Soroban, NEAR, ICP, or any non-EVM chain, and do not trigger on Solidity development help requests (writing, formatting, learning) that are not audit-framed.