Adversarial bug hunting with a sequential-first pipeline (Recon, Hunter, Skeptic, Referee) that can optionally use safe read-only parallel triage. Finds, verifies, and auto-fixes real bugs by default (with --scan-only opt-out) using checkpointed verification and resume state for large codebases. Use this skill whenever the user wants bug finding, security audits, regression checks, or code review focused on runtime behavior.
How to install bug-hunter?
codexstar69/bug-hunter
$npx -y skills add codexstar69/bug-hunter --skill bug-hunterInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Run `npx skills use "https://github.com/codexstar69/bug-hunter" --skill "codexstar69/bug-hunter"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.
Use the skills in "https://github.com/codexstar69/bug-hunter" that are relevant to the current task. Run `npx skills add "https://github.com/codexstar69/bug-hunter"` and select the relevant skills, then follow their instructions.
SKILL.md
| 1 | <p align="center"> |
| 2 | <img src="docs/images/hero.png" alt="Bug Hunter — AI-powered adversarial code review and security vulnerability scanner for Claude Code, Cursor, Codex, Copilot, Windsurf, and Kiro" width="720"> |
| 3 | </p> |
| 4 | |
| 5 | <h1 align="center">Bug Hunter</h1> |
| 6 | <p align="center"><strong>AI code review that argues with itself — adversarial multi-agent bug finding, security scanning, and auto-fix for any coding agent.</strong></p> |
| 7 | |
| 8 | <p align="center"> |
| 9 | <a href="https://www.npmjs.com/package/@codexstar/bug-hunter"><img src="https://img.shields.io/npm/v/@codexstar/bug-hunter" alt="npm version"></a> |
| 10 | <a href="https://github.com/codexstar69/bug-hunter/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/@codexstar/bug-hunter" alt="MIT License"></a> |
| 11 | <img src="https://img.shields.io/badge/tests-113%20passing-brightgreen" alt="113 tests passing"> |
| 12 | <img src="https://img.shields.io/badge/node-%3E%3D18-blue" alt="Node.js >= 18"> |
| 13 | </p> |
| 14 | |
| 15 | <p align="center"> |
| 16 | <a href="#install">Install</a> · |
| 17 | <a href="#quick-start">Quick Start</a> · |
| 18 | <a href="#how-adversarial-ai-code-review-works">How It Works</a> · |
| 19 | <a href="#bugs-and-vulnerabilities-detected">What It Finds</a> · |
| 20 | <a href="#safe-auto-fix-with-canary-rollout">Auto-Fix</a> · |
| 21 | <a href="#cli-flags">CLI Reference</a> |
| 22 | </p> |
| 23 | |
| 24 | --- |
| 25 | |
| 26 | Bug Hunter is an open-source AI code review and security vulnerability scanner that works as a skill/plugin for AI coding agents. Three AI agents — a Hunter, a Skeptic, and a Referee — independently analyze your code in an adversarial pipeline. The Hunter finds bugs. The Skeptic tries to disprove them. The Referee delivers the final verdict. Only bugs that survive all three stages make the report, eliminating the false positive overload that plagues other AI code review tools. |
| 27 | |
| 28 | It then auto-fixes confirmed bugs with a safe canary rollout pipeline — git branching, test baselines, per-fix commits, automatic rollback on failure, and post-fix re-scanning. |
| 29 | |
| 30 | --- |
| 31 | |
| 32 | ## Install |
| 33 | |
| 34 | ```bash |
| 35 | npx skills add codexstar69/bug-hunter |
| 36 | ``` |
| 37 | |
| 38 | Or via npm: |
| 39 | |
| 40 | ```bash |
| 41 | npm install -g @codexstar/bug-hunter |
| 42 | bug-hunter install # auto-detects your IDE/agent |
| 43 | bug-hunter doctor # verify environment |
| 44 | ``` |
| 45 | |
| 46 | Or clone: |
| 47 | |
| 48 | ```bash |
| 49 | git clone https://github.com/codexstar69/bug-hunter.git ~/.agents/skills/bug-hunter |
| 50 | ``` |
| 51 | |
| 52 | > **Requirements:** Node.js 18+ recommended. Core pipeline works without it. |
| 53 | > |
| 54 | > **Compatible with:** Claude Code, Cursor, Codex CLI, Windsurf, Kiro, Copilot, Opencode, [Pi](https://github.com/mariozechner/pi-coding-agent) — or any AI agent that can read files and run shell commands. |
| 55 | |
| 56 | --- |
| 57 | |
| 58 | <p align="center"> |
| 59 | <img src="docs/images/2026-03-12-pr-review-flow.png" alt="Bug Hunter PR review workflow — pull request scope analysis, security checks, threat-model context, and final verdict" width="100%"> |
| 60 | </p> |
| 61 | |
| 62 | ## Quick Start |
| 63 | |
| 64 | ```bash |
| 65 | /bug-hunter # scan project, auto-fix confirmed bugs |
| 66 | /bug-hunter src/ # scan a specific directory |
| 67 | /bug-hunter --scan-only src/ # report only, no code changes |
| 68 | /bug-hunter --pr # review the current pull request |
| 69 | /bug-hunter --pr-security # PR security review + threat model + CVEs |
| 70 | /bug-hunter --deps --threat-model # full security audit |
| 71 | ``` |
| 72 | |
| 73 | --- |
| 74 | |
| 75 | ## How Adversarial AI Code Review Works |
| 76 | |
| 77 | <p align="center"> |
| 78 | <img src="docs/images/pipeline-overview.png" alt="Bug Hunter adversarial AI code review pipeline — triage, recon, deep scan, skeptic challenge, referee verdict, auto-fix with canary rollout" width="100%"> |
| 79 | </p> |
| 80 | |
| 81 | ``` |
| 82 | Triage → Recon → Hunter → Skeptic → Referee → Fix Plan → Fixer → Verify |
| 83 | (<2s) ↕ doc verify ↕ doc verify |
| 84 | ``` |
| 85 | |
| 86 | 1. **Triage** — classifies every file by risk in <2 seconds, zero AI tokens |
| 87 | 2. **Recon** — maps tech stack, auth mechanisms, attack surfaces |
| 88 | 3. **Hunter** — deep behavioral scan for logic errors, security vulnerabilities, race conditions |
| 89 | 4. **Skeptic** — adversarial review that tries to *disprove* every finding with counter-evidence |
| 90 | 5. **Referee** — independent final j |
Related
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration.Jul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks.Jul 2026
- entra-agent-idProvision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token…Jul 2026
- firebase-security-rules-auditorAudits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource…Jul 2026
- golang-securitySecurity best practices and vulnerability prevention for Golang.Jul 2026
- gws-modelarmorGoogle Model Armor: Filter user-generated content for safety.Jul 2026
