Updated 2mo ago
by codexstar69
bug-hunter
Adversarial AI bug hunter with auto-fix skill for Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI, Opencode, Pi Coding Agent, and more. Multi-agent pipeline finds security vulnerabilities, logic errors, and runtime bugs — then fixes them autonomously on a safe branch.
524 GitHub stars (524)
+12 in 16 days
| Period | New stars |
|---|---|
| Oct 1 | +1 |
| Oct 2 | +2 |
| Oct 3 | 0 |
| Oct 4 | +1 |
| Oct 5 | 0 |
| Oct 6 | +1 |
| Oct 7 | +2 |
| Oct 8 | 0 |
| Oct 9 | 0 |
| Oct 10 | +1 |
| Oct 11 | +1 |
| Oct 12 | +1 |
| Oct 13 | +1 |
| Oct 14 | +1 |
| Oct 15 | 0 |
| Oct 16 | 0 |
- 11 skills (11 skills found in its SKILL.md files)
- 63 forks (63 forks)
- 2mo ago last update (Last updated 2mo ago)
Install
Skills CLI
npx skills add codexstar69/bug-hunter
Asks which skills and agents to install. Just one: npx skills add codexstar69/bug-hunter --skill bug-hunter — add -g for every project.
Claude Code
git clone https://github.com/codexstar69/bug-huntercp -r "bug-hunter" ~/.claude/skills/bug-hunter
Copies the bug-hunter skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add codexstar69/bug-hunter
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
bug-hunter
Precision-first adversarial bug hunting for runtime, logic, data, concurrency, and security defects. Uses deterministic risk triage, evidence-bounded retrieval, Hunter/Skeptic/Referee review, optional hybrid verification, and explicit immutable Fixer scope. Scan-only and single-pass by default; complete-coverage loops, edits, autonomous fixes, and commits each require explicit intent. Use for cod…
SKILL.md on GitHub (opens in a new tab) -
commit-security-scan
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.
skills/commit-security-scan/SKILL.md on GitHub (opens in a new tab) -
doc-lookup
Unified documentation lookup for Bug Hunter agents. Uses Context Hub (chub) as primary source with Context7 API fallback. Provides verified library/framework documentation to prevent false positives and ensure correct fix patterns.
skills/doc-lookup/SKILL.md on GitHub (opens in a new tab) -
fixer
Surgical code fixer for Bug Hunter. Implements minimal, precise fixes for verified bugs. Uses doc-lookup (Context Hub + Context7) to verify correct API usage in patches. Respects fix strategy classifications (safe-autofix vs manual-review vs larger-refactor).
skills/fixer/SKILL.md on GitHub (opens in a new tab) -
hunter
Deep behavioral code analysis agent for Bug Hunter. Performs multi-phase scanning to find logic errors, security vulnerabilities, race conditions, and runtime bugs. Uses doc-lookup (Context Hub + Context7) for framework verification. Reports structured JSON findings.
skills/hunter/SKILL.md on GitHub (opens in a new tab) -
recon
Codebase reconnaissance agent for Bug Hunter. Maps architecture, identifies trust boundaries, classifies files by risk priority, and detects service boundaries. Does NOT find bugs — finds where bugs hide.
skills/recon/SKILL.md on GitHub (opens in a new tab) -
referee
Final arbiter for Bug Hunter. Receives Hunter findings and Skeptic challenges, independently re-reads code, and delivers authoritative verdicts with CVSS scoring and proof-of-concept generation for security findings.
skills/referee/SKILL.md on GitHub (opens in a new tab) -
security-review
Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.
skills/security-review/SKILL.md on GitHub (opens in a new tab) -
skeptic
Adversarial code reviewer for Bug Hunter. Rigorously challenges each reported bug to determine if it's real or a false positive. Uses doc-lookup (Context Hub + Context7) to verify framework claims before disproval. The immune system that kills false positives.
skills/skeptic/SKILL.md on GitHub (opens in a new tab) -
threat-model-generation
Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts. Use whenever the repository has no threat model yet, the architecture changed materially, a security review needs fresh trust-boundary context, or the user explicitly asks for a threat model.
skills/threat-model-generation/SKILL.md on GitHub (opens in a new tab) -
vulnerability-validation
Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable.
skills/vulnerability-validation/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.