Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    deepbug hunter

    2

    Systematic bug hunting that proves findings with data flow traces and reproducing unit tests.

    $10

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    deepbug hunter

    deepbug hunter

    Example session with this skill installed

    Audit the /services/payment-processor module in this repo for logic bugs. I have authorization to test this code.

    • Read your context and instructions
    • Compiled the deepbug hunter

    I have audited the /services/payment-processor module. After mapping entry points and tracing data flows, I identified one confirmed logic flaw regarding floating-point precision during currency conversion.

    Confirmed Finding: Precision Loss in Multi-Currency Settlement

    IDClassRiskPathStatus
    DBH-001Arithmetic/PrecisionHighPOST /settle -> Converter.calculate() -> DB.update()Confirmed

    Trace Analysis

    1. Entry: SettlementController.js:42 receives amount as a float from the request body.
    2. Sink: CurrencyService.js:108 performs Math.round(amount * rate) before passing to the ledger.

    Flaw: The rounding occurs before the final summation in the batch processor, leading to a discrepancy of up to 0.04 units per 100 transactions in high-frequency environments.

    Reproduction Test

    const { calculateSettlement } = require('./services/payment-processor');
const assert = require('assert');

describe('DeepBug Hunter Reproduction: DBH-001', () => {
  it('should fail when cumulative rounding errors exceed 0.01', () => {
    const rate = 1.255;
    const inputs = [10.11, 10.11, 10.11]; // Total expected: 38.07435 -> 38.07
    const results = inputs.map(val => Math.round(val * rate * 100) / 100);
    const sum = results.reduce((a, b) => a + b, 0);
    
    // The current implementation rounds per-item instead of at the total.
    // sum is 38.10, expected is 38.07.
    assert.strictEqual(sum, 38.07, 'Cumulative precision error detected in settlement');
  });
});

    Next steps

    1. Refactor CurrencyService.js to use BigInt or a decimal library for all intermediate calculations.
    2. Move the rounding operation to the final step of the batch settlement process.
    3. Run scripts/dedupe_findings.py after applying the fix to clear the report.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Auditing a codebase for subtle logic flaws often results in superficial suggestions rather than actionable fixes. DeepBug Hunter stops the guesswork by enforcing a rigorous verification workflow for every potential vulnerability. It eliminates false positives by requiring a traced data flow and a functional reproduction test for every reported issue.

    What it does

    • Surface mapping identifies entry points, privileged operations, and risky sinks within the repository.
    • Risk prioritization focuses analysis on critical modules like auth, financial logic, and state transitions.
    • Hypothesis generation uses structured bug classes to identify specific failure modes in code logic.
    • Verification tracing tracks data from input to failure point to confirm if guards are bypassed.
    • Minimal reproduction generates failing unit tests to prove the existence of every confirmed bug.

    How it works

    1. Trigger the skill by providing a path to a codebase you are authorized to test.
    2. The agent maps the surface area and identifies high-risk sinks and entry points.
    3. The agent formulates hypotheses based on language-specific bug classes and traces data flows.
    4. You receive a report containing confirmed findings, traced paths, and reproducing unit tests.

    Frameworks & tools

    This skill works with any codebase where local scripts for mapping and static analysis can be executed. It includes specialized modules for python mapping and uses structured JSON for finding deduplication.

    Why this beats prompting it yourself

    Standard prompts often hallucinate bugs or miss deep concurrency and state issues. This skill enforces a "no proof, no report" rule, ensuring you only spend time on verified, reproducible flaws rather than generic "best practice" advice.

    Use cases

    • Audit financial logic for precision errors or race conditions in transaction flows.
    • Identify auth bypasses by tracing data from external inputs to privileged sinks.
    • Find edge-case state transition bugs in complex backend services.
    • Clean up legacy repositories by identifying dead code paths and logic gaps.

    Known limitations

    Requires authorization to run analysis scripts on the repo. Does not produce weaponized exploits or perform live system attacks.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 15 days ago

    • Passed all security checks, Safe to install

    Listed15 days ago

    What's inside

    Frequently Asked Questions