菜单
Run kuzushi preflight diagnostics — Node dependencies, plugin MCP server health, and which analysis CLIs and LSP servers are installed, with exact install commands for anything missing. Use when tooling shows as missing or MCP servers won't connect.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Interprocedural, hypothesis-driven hunt — finds the multi-file source→sink bugs that pattern-gating and same-file taint miss. Ranks trace anchors (entry points + dangerous sinks), then the deep-hunter agent walks each flow ACROSS files (forward/backward call-graph CLIs) over multiple rounds, confirming propagation and defeating guards, and promotes confirmed cross-file flows into findings.json with the path stored as evidenceGraph. Token-expensive, budget-bounded. Part of the HUNT phase (run via /sweep --deep, or ask for it); leads flow to /verify (panel).
Whole-file deep reader — finds bugs by READING risk-ranked files in full and reasoning from first principles, not by grepping for known patterns. Catches the long tail (project-specific wrappers, business logic, cross-function flaws) that pattern-gated producers structurally miss. Token-expensive; budget-bounded and risk-ranked. Promotes leads into .kuzushi/findings.json (source "deep-scan").
IRIS-style source→sink taint hunt. Ranks a typed CWE catalog for the repo, then drives subagents to label dangerous sinks, label sources of user input, run Joern/CodeQL dataflow queries (or same-file linking) to connect them, and triage each flow as finding/candidate/rejected. Promotes verdicts into .kuzushi/findings.json. Benefits from a prebuilt CodeQL DB / Joern CPG but degrades gracefully.
Adversarial per-threat review (Carlini doctrine). For each threat in .kuzushi/threat-model.json, state attacker capabilities, walk source→sink, attempt to bypass every guard, and assign a verdict with evidence. Promotes findings into .kuzushi/findings.json. Requires /threat-model first.
Split the attack surface into parallel-discovery partitions so fan-out hunters explore different subsystems instead of converging on the same shallow bug. Deterministic grouping of /x-ray entry points by component → .kuzushi/partitions.json, which a hunt coordinator hands to one subagent per partition. Run /x-ray first.
Empirical proof-of-concept for the PoC-ready findings. For each finding /verify marked confirmed-exploitable or inconclusive, synthesize a minimal harness that triggers the bug; a host script then runs it in a sandbox (Docker --network none when present, else a gated local run) and classifies the crash into a proof verdict. Attaches a poc block onto each finding. Requires /verify first.
| name | doctor |
| user-invocable | true |
| description | Run kuzushi preflight diagnostics — Node dependencies, plugin MCP server health, and which analysis CLIs and LSP servers are installed, with exact install commands for anything missing. Use when tooling shows as missing or MCP servers won't connect. |
| allowed-tools | Bash |
Run the plugin's diagnostics and report the result to the user.
Execute:
node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/doctor.mjs"
Then relay its output verbatim (it's already a readable table). If anything is marked
✗, surface the exact install: command the report prints for it. Note the distinction it
draws for MCP servers: server ✓ means the plugin's Node server connects; CLI ✓ means
the external tool it drives (codeql, joern, semgrep, …) is installed. A server can be ready
while its CLI is missing — those tools return a structured "missing" response until the CLI
is installed.
/install to fix what's ✗./build-databases.