菜单
Generates a structured Bug Fix Brief (BFB) to document issue corrections. Includes root cause analysis, repro steps, fix options, and fix checklist. Use when user asks to create a BFB, document a bug fix, or generate a bug correction document.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | bug-fix-brief |
| description | Generates a structured Bug Fix Brief (BFB) to document issue corrections. Includes root cause analysis, repro steps, fix options, and fix checklist. Use when user asks to create a BFB, document a bug fix, or generate a bug correction document. |
| allowed-tools | Read, Write, AskUserQuestion, Glob |
This skill generates a Bug Fix Brief (BFB): a structured document in docs/bfb/ that uniformly captures every bug fix with root cause, repro steps, fix options, and checklist.
Trigger: "create BFB", "document bug", "bug fix brief", "document fix"
Check existing numbering:
ls docs/bfb/ 2>/dev/null || echo "Directory does not exist"
Ask the user for:
Complete the full BFB template:
## BFB-XXX: [Title]
**Reference:** [Issue link]
**Environment:** [Env] `vX.Y.Z`
**Date:** YYYY-MM-DD
---
### 1. Bug
- **Observed:** [wrong behavior]
- **Expected:** [correct behavior]
### 2. Repro
### 3. Cause
`path/file.ext` — `function()` @ line N
[Why it happens, max 3 lines]
### 4. Decision
| Option | Fix | Choice |
|--------|-----|--------|
| A | [desc] | ✅/❌ |
| B | [desc] | ✅/❌ |
**Rationale:** [why]
### 5. Fix
- [ ] [change 1]
- [ ] [test]
- [ ] [verify repro]
### 6. Notes
[recurring patterns, links, warnings]
Show the generated BFB and ask with AskUserQuestion:
Only after approval:
mkdir -p docs/bfb
Write to docs/bfb/BFB-XXX-title.md
Input: "create BFB for login email null crash"
Final output:
## BFB-042: Login crash with null email
**Reference:** #1287
**Environment:** Prod `v2.4.1`
**Date:** 2026-05-02
---
### 1. Bug
- **Observed:** App crashes if email field is empty
- **Expected:** Error message "Email required"
### 2. Repro
### 3. Cause
`AuthManager.kt` — `validateEmail()` @ line 34
Missing null check on email.trim()
### 4. Decision
| Option | Fix | Choice |
|--------|-----|--------|
| A | Add safe call `?.` | ✅ |
| B | Refactor with Result type | ❌ |
**Rationale:** Option A is minimal, zero impact.
### 5. Fix
- [ ] Add `email?.trim()?.isNotEmpty() == true`
- [ ] Test `validateEmail_null_returnsFalse()`
- [ ] Verify repro
### 6. Notes
- Check other forms for missing null checks
docs/bfb/: Create if it does not existPosts review findings from a JSON file as inline comments on a GitHub Pull Request, attaching each comment to its file and line. Use when you have a list/JSON of review findings (each with a file path, line number, and a message such as summary/failure_scenario) and want them published on a PR as inline review comments. Triggers include "post these review comments on the PR", "associate comments to files in the PR", "publish review findings to PR
Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure. Use when performing security audits, before deployment, reviewing authentication/authorization implementations, or ensuring OWASP compliance for Express, NestJS, and Next.js. Triggers on "security review", "check for security issues", "TypeScript security audit".
Initialize Spec-Driven Development context — detects tech stack, conventions, architecture patterns, and bootstraps persistence backends. Triggers on 'sdd-init', 'init sdd', 'setup sdd', 'initialize sdd', 'setup project', 'initialize project context'. Creates/updates docs/specs/architecture.md & ontology.md (Constitution), and populates knowledge-graph.json.
Explore codebase before committing to a change. Phase executor skill for specs.explore command.
Optimizes raw idea descriptions into structured prompts ready for the brainstorming workflow. TRIGGER when: user says "optimize for brainstorm", "prepare idea for brainstorm", "enhance this idea", "make this ready for brainstorming", "imposta per brainstorm", or wants to improve a feature idea before using /specs.brainstorm. DO NOT TRIGGER for code optimization, refactoring, or general prompt engineering tasks.
Executes real end-to-end verification against a running application after specification implementation. Detects the application type, starts the local runtime (Docker, Node, Spring Boot, etc.), runs real tests (curl for REST APIs, Playwright for web SPAs, computer-use for desktop apps), verifies acceptance criteria from the functional specification, generates a markdown report, and tears down the environment. Use when: user asks to verify a completed spec with real tests, run e2e checks after implementation, validate acceptance criteria in a live environment, or test the feature for real after task completion.