Quality

Eval Harness defines capability, regression, and human-review evals for Claude Code sessions. Use it to plan work before coding, run checks during implementation, and report pass@k results.

Extract Error Codes runs `yarn extract-errors` to find new React errors that need codes assigned. Use it when adding error messages or when warnings say an error code is unknown.

Frontend Code Review reviews `.tsx`, `.ts`, and `.js` files for checklist violations. Use it for pending changes or named files before code is submitted.

Review Loop runs an implement-then-check cycle with a fresh independent checker before a change is marked done. Use it for behavioral changes, especially when you need an adversarial second pass on the current revision.

Security Pipeline runs CWE Top 25 checks, STRIDE analysis, and pre-commit vulnerability scanning when sensitive code changes or security commands are used. It helps gate commits and review fixes for common security issues.

Business Logic Hunting finds logic flaws in payment, auth, and subscription flows such as price manipulation, race conditions, MFA bypass, and trial abuse. Use it when testing for workflow skipping or client-side state trust issues.

Chemistry Accuracy And Cost For Every Module You Swap In helps evaluate drop-in replacement modules by reporting both accuracy and cost for each alternative. Use it when a paper claims a substituted layer is more accurate and cheaper, and you need matched comparisons and normalized runtime ratios.

Chemistry Reproduction Path helps you reproduce a published benchmark score by matching the source's exact scoring path before changing anything. Use it to document splits, filtering, ordering, checkpoint choice, pooling, and seed aggregation, then compare each step against your own run.

Correlate runs a finding correlation engine to turn individual findings into attack chains. Use it after collecting bugs to identify multi-step paths, document reproduction steps, and surface high-impact chains.

Detection Score Population Claims explains how to compare detection or ranking scores across studies by publishing the candidate population, checking prevalence effects, and describing extra detections. Use it when a score or arm comparison could be distorted by different denominators or unlabeled items.

Duplicate Check searches platform hacktivity and local findings to see whether a vulnerability has already been reported. Use it before writing up a finding to judge duplicate risk and related prior art.

Hunt IDOR finds insecure direct object references and broken object level authorization issues in web apps, APIs, GraphQL, and multi-tenant services. Use it when testing for cross-tenant data access, object ID tampering, and field-level authorization gaps.