codexstar69/bug-hunter

Bug Hunter runs precision-first adversarial code audits with Hunter, Skeptic, and Referee review roles. Use it for bug hunting, security audits, PR review, and evidence-backed remediation planning with scan-only defaults unless edits are explicitly requested.

Commit Security Scan reviews changed code for security issues using Bug Hunter artifacts and STRIDE context. Use it for PR reviews, staged diffs, branch comparisons, and pre-merge checks of modified files.

Doc Lookup verifies claims about library, framework, and API behavior using Context Hub first, with Context7 as fallback. Use it when a bug verdict depends on whether the docs confirm a specific behavior or fix pattern.

Fixer implements minimal, precise code changes for verified bugs. It uses doc lookup to verify API usage and follows assigned fix strategies like safe-autofix or manual-review.

Hunter performs deep multi-phase code analysis to find runtime bugs, logic errors, security issues, and race conditions. Use it when you need structured JSON findings from a codebase scan.

Recon maps a codebase’s architecture, trust boundaries, service boundaries, and high-risk files for bug hunting. It does not find bugs; it identifies where bugs are most likely to hide.

Referee independently re-reads code, compares Hunter findings with Skeptic challenges, and issues final verdicts with severity and proof-of-concept guidance. Use it when security or correctness claims need a definitive call.

Security Review runs a STRIDE-based audit using Bug Hunter artifacts for full, PR-scoped, staged, or weekly security checks. Use it when you need threat-model context, dependency CVEs, and validated findings in one workflow.

Skeptic rigorously challenges reported bugs to separate real issues from false positives. It re-reads the relevant code and verifies framework behavior before disproving a finding.

Threat Model Generation creates a STRIDE-based threat model and security config for the current repository using Bug Hunter artifacts. Use it when a project lacks a threat model, its architecture changes, or a security review needs updated trust-boundary context.

Vulnerability Validation checks suspected security findings for reachability, exploitability, mitigations, and real-world impact. Use it after scans or before fixes to confirm whether a finding is actually exploitable.