bug-hunter

name	bug-hunter
description	Use this skill when scanning source code for bugs, anti-patterns, code smells, or quality issues in a WrongStack project. Triggers: user says "bug", "bug hunt", "scan for issues", "find problems", "anti-pattern", "code smell", "static analysis".
version	1.1.0

Bug Hunter — WrongStack

Scans code for bugs and code smells. Outputs a prioritized hit list with file:line references.

Overview

Grep/read across target files to surface bugs, anti-patterns, and quality issues. Classifies by severity (critical/high/medium/low) and reports with file:line + fix suggestion.

Rules

1. Always include file:line in every finding — no line reference = can't be fixed.
2. Never scan node_modules — waste of time, false positives.
3. Don't report style issues as bugs — those are lint findings.
4. If >30% of findings are noise, note the false positive rate in the report.
5. Don't flag deprecated APIs without severity — some deprecations are acceptable.
6. Sort output: critical > high > medium > low.

Workflow

1. Scope:  Accept file/dir globs or explicit paths
2. Scan:   grep/read across target files
3. Classify: Categorize by type and severity
4. Rank:   Sort: critical > high > medium > low
5. Report: Markdown with fix suggestions

Severity levels

Level	Meaning	Action
Critical	Security breach, data loss, crash	Fix immediately
High	Logic bug, race condition, memory leak	Fix before release
Medium	Error handling gap, type unsafety	Fix soon
Low	Style, minor code smell	Consider fixing

Patterns

Do

// ✅ FIXED — use textContent instead of innerHTML
element.textContent = userInput;

// ✅ FIXED — parameterized query
db.query("SELECT * FROM users WHERE id = $1", [userId]);

// ✅ FIXED — proper await with catch
await fetchData().catch(err => console.error(err));

// ✅ FIXED — execFile with args array
execFile('echo', [userInput], { signal: AbortSignal.timeout(5000) });

Don't

// ❌ CRITICAL — hardcoded API key
const apiKey = "sk-abc123xyz789...";

// ❌ HIGH — innerHTML XSS
element.innerHTML = userInput;

// ❌ HIGH — unhandled promise (then without catch)
fetchData().then(processData);

// ❌ HIGH — shell injection
exec(`echo ${userInput}`);

// ❌ HIGH — unsafe any
const data: any = response.json();

Bug patterns to find

Pattern	Regex hint	Severity
Uncaught promise	\.then\( without .catch	high
Event listener leak	on( without off/removeListener	high
Hardcoded secret	[A-Za-z0-9/+=]{40} in config or code	critical
unsafe any	: any\b or as any	medium
innerHTML assignment	innerHTML\s*=	high
Missing await	await not used on async call	high
Unhandled rejection	process.on('unhandledRejection'	medium
SQL concatenation	"SELECT * FROM " + table	critical
Shell injection	exec(\cmd ${input}`)`	critical

Anti-patterns

• Don't scan node_modules — waste of time, false positives
• Don't report without file:line — useless for fixing
• Don't ignore false positive rate — if >30% of findings are noise, note it
• Don't report style issues as bugs — those are lint findings
• Don't flag deprecated without severity — some deprecations are fine

Output format

## Bug Hunt Report — <scope>

### Critical (must fix)
1. [SHELL-INJ] `tools/shell.ts:42` — template literal in exec()
   `exec(\`echo ${userInput}\`)` → use execFile with args array
2. [SECRET] `lib/config.ts:8` — API key hardcoded

### High
3. [MEMORY] `tools/pool.ts:89` — event listener never removed
4. [TYPE] `core/agent.ts:103` — unsafe `any` cast

### Summary
| Severity | Count |
|----------|-------|
| Critical | 2 |
| High     | 4 |
| Medium   | 7 |
| Low      | 3 |

Total: 16 findings in 12 files

Skills in scope

• security-scanner — for hardcoded secrets and injection vectors
• refactor-planner — for fixing findings across multiple files
• typescript-strict — for type-safety related findings