Bug Hunter

---

title: Bug Hunter description: > Install and use the measurable adversarial code-audit skill with scan-only defaults and explicit permission before source edits. prompt: | Explain and use the current Bug Hunter protocol accurately. Keep scan-only and single-pass defaults unless the user explicitly requests loop coverage or mutation. Prefer canonical JSON artifacts, evidence-backed adversarial review, bounded adaptive/retrieval context, and fail-closed verification.

Bug Hunter Adversarial code auditing for AI coding agents.

Bug Hunter is an AI-agent skill for code review and security auditing. A Hunter finds possible bugs, a Skeptic challenges each claim, and a Referee decides what the evidence supports. The default run only scans and reports. It is single-pass unless --loop is explicitly requested. Editing, autonomous fixing, and commits each require explicit permission.

v3.2.0 source — measurable, adaptive bug hunting

The current v3.2.0 source makes the precision-first pipeline measurable and adaptive while preserving the scan-only default and fail-closed safety boundaries. The latest published npm release may lag GitHub main; use the current-source command below when you need the exact implementation documented on this page.

• Measurable benchmark quality gate scores one-to-one finding matches, precision, recall, F1, severity-weighted recall, false positives per KLOC, calibration, repeat stability, token usage, latency, and cost data when supplied.
• Adaptive execution profiles select fast, balanced, or assurance behavior from triage risk, security scope, benchmark evidence, stability, calibration, and token efficiency.
• Hybrid verification safely runs argv-only tests, type checks, static checks, fuzz checks, and security-static checks, and fails closed when required verification fails or is unavailable.
• Exact evidence caching reuses evidence only when source content, protocol identity, role, and relevant configuration match exactly; changed source cannot inherit stale conclusions.
• Hypothesis-driven retrieval prioritizes direct files, symbols, dependencies, dependents, cross-references, and trust boundaries under hard context budgets.
• Stronger source integrity keeps scan scope, source hashes, resume identity, coverage state, and Fixer authorization explicit and rejects source drift.
• Permanent CI quality gates verify Node.js 22 and 24; the Node.js 24 lane also runs the benchmark quality gate and package inventory verification.
• Bundled security workflows cover PR-focused security review, full repository security review, STRIDE threat modeling, vulnerability validation, and supported dependency CVE scanning.

The bundled deterministic regression fixture currently records precision 1.00, recall 1.00, F1 1.00, repeat stability 1.00, zero false positives, median 12,090 tokens per true positive, p95 duration 61.3s, and expected calibration error about 0.048. These figures validate the bundled harness and fixture; they are not an independent benchmark of every repository or model.

See the measurable world-class protocol for the full architecture, artifact contracts, quality thresholds, and verification design.

TL;DR

Install the exact current GitHub source documented here. Replace codex with a target from the table below.