// Launch an adversarial bug-hunting code reviewer (Opus) to find real bugs, correctness issues, concurrency hazards, and server/resource abuse risks — not style nits. Use when the user asks for a "red team", "bug hunt", "adversarial review", or at checkpoints during long coding tasks.
Launch an adversarial mutation-testing agent (Opus) that injects targeted regressions into production code, runs the test suite, and reports which mutations SURVIVED — surviving mutations are direct evidence of test-coverage gaps. Use when the user says "trickster", "mutation test", "break the code", "can the tests catch regressions", "grade the tests", or after adding production code whose test coverage you're not sure about.
Launch an adversarial reviewer (Opus) to find bugs IN THE TEST SUITE — tautological assertions, weak oracles, shim/mock lies, stale fixtures, coverage gaps, clock-mock pitfalls. Use when the user says "red team the tests", "audit the tests", "are our tests any good", "find weak tests", or after adding a large batch of tests that needs scrutiny.
Run a bounded live audit of the extension against multiple HN handles in parallel — Playwright + real Chromium + real HN, time-series snapshots, deterministic divergence analysis. Use when the user asks to "audit", "sit and observe", "live test", or "check whether the extension is correctly tracking real HN activity across multiple users". Bounded by wall time AND request budget — never unbounded.
Launch a Jony Ive–style product design adversary (Opus) to critique UI/UX *within* the project's existing aesthetic constraints. Finds what is graceless, disproportionate, clumsy — in the designer's own voice. Use when the user wants a "design critique", "Jony Ive review", "UI review", or says the interface "needs improvement".
| name | red-team-review |
| description | Launch an adversarial bug-hunting code reviewer (Opus) to find real bugs, correctness issues, concurrency hazards, and server/resource abuse risks — not style nits. Use when the user asks for a "red team", "bug hunt", "adversarial review", or at checkpoints during long coding tasks. |
Launches an Opus general-purpose agent as an adversarial code reviewer.
For a different-model-family cross-check, the maintainer runs additional adversary passes (e.g., Opus 4.6, other providers) out-of-band in a separate harness. This skill stays on Opus because that's what the Agent tool resolves "opus" to today, and it gives the highest-depth pass of anything available through the built-in tool.
Use the Agent tool with:
subagent_type: "general-purpose"model: "opus"description: 3–5 word description (e.g. "Red-team review after X")prompt: follow the template belowFill in the bracketed sections with real project context before invoking. Do NOT send the template as-is.
You are an adversarial code reviewer performing a red-team bug hunt on
[PROJECT NAME / KIND]. You find real bugs, correctness issues,
concurrency hazards, and server/resource abuse risks — NOT style nits.
Rank findings by severity (CRITICAL / HIGH / MEDIUM / LOW).
## Project
[ABSOLUTE PATH]
[2-3 sentences on what it does and the runtime/deployment model —
e.g. "Chrome MV3 extension, Svelte sidepanel, polls Firebase API on
chrome.alarms cadence."]
## What changed since last review (if applicable)
[Bullet list of notable changes with file:line anchors. If no prior
review, describe the full surface area.]
## What to hunt
Group concerns. Examples (adapt to the project):
- Server/resource abuse: retry storms, alarm storms, unbounded loops,
missing rate limits, concurrency guards
- Data corruption: read-modify-write races on shared stores without CAS
- Security: XSS via {@html} or innerHTML, unsanitized URLs, JSON-in-URL,
access-control gaps
- Correctness: wrong invariants, silent fallbacks masking errors, edge
cases (deleted/dead items, clock skew, timezone, duplicate inputs)
- Lifecycle: MV3 SW suspensions, page refresh, concurrent tabs, alarm races
- Tests that validate mocks, not behavior
## Output format
~300–500 words. Group by severity. For each finding:
- file:line reference
- one-sentence description of the bug
- one-sentence trigger/exploit condition
Do NOT propose fixes (just the bug). End with a one-sentence risk
delta vs the previous review if one exists.
Be terse. Be specific. Find real bugs.
This skill currently uses no scripts. If future versions need helper scripts for, say, parsing the review output into a ranked TODO list, they go in this folder:
.claude/skills/red-team-review/
SKILL.md # this file
<helper>.mjs # optional helpers, live here only
This skill must clean up after itself. The adversary agent is read-only by design and should not create files. If you (or it) produce any scratch artifacts:
.md file in the repo unless requested.Before returning control to the user, verify no stray files were left
in the repo root, .claude/tmp/ (if used), or elsewhere. A final
git status check is cheap.