abczsl520

Bug Audit Skill — Security skill for Claude Code

Security community

OpenClaw skill: Dynamic bug audit for Node.js web projects (games, data tools, WeChat, APIs, bots).

How to install Bug Audit Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open abczsl520/bug-audit-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Bug Audit Skill does

OpenClaw skill: Dynamic bug audit for Node.js web projects (games, data tools, WeChat, APIs, bots). 200+ real-world pitfalls.

Alternatives in Security

Cve MCP Server — Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS sco 1.2k ★
/web3 Audit — Smart contract security audit using the 10-bug-class methodology 927 ★
Bountyforge — All-round bug bounty skill for Claude Code parallelized agents for smart contract audits (EVM, Move, Solana, T 399 ★

README

🔍 Bug Audit Skill

[![ClawHub](https://img.shields.io/badge/ClawHub-bug--audit-blue?style=flat-square)](https://clawhub.com) [![License: MIT](https://img.shields.io/badge/License-MIT-green?style=flat-square)](LICENSE) [![OpenClaw Skill](https://img.shields.io/badge/OpenClaw-Agent_Skill-orange?style=flat-square)](https://github.com/openclaw/openclaw)

Don't run a checklist. Dissect the project, then exhaustively verify every entity.

Built from a hard lesson: a project took **21 rounds** to find 172 bugs using generic checklists. Post-mortem revealed that building project-specific check matrices first would have caught most bugs in **3-4 rounds**.

The Problem with Checklists

Generic checklists catch "known pattern" bugs (CORS, XSS, timezone). But most critical bugs are **project-specific logic vulnerabilities**:

buy API accepts cost=0 → free purchases (not in any checklist)
raid-result callable without calling buy first → infinite money exploit
Search completion doesn't verify distance → remote looting

These bugs live in the **relationships between APIs**, not in individual code patterns.

The Solution: Dissect → Verify → Supplement

Phase 1: Dissect — Read code, build 6 project-specific tables (10-15 min)
Phase 2: Verify  — Exhaustively check every row in every table
Phase 3: Supplement — Run generic modules as safety net
Phase 4: Regress — Check fixes didn't introduce new bugs
Phase 5: Archive — Record pitfalls for next audit

The 6 Tables

Table	Extracts	Key Question
API Endpoints	Every route: method, path, auth, params	Can I bypass? What if I send garbage?
State Machines	Every state variable: setter, reader, lifecycle	Does it leak across lifecycles?
Timers	Every setTimeout/setInterval	Does it fire after cleanup?
Numeric Values	Every user-influenceable number	What if 0? Negative? Huge?
Data Flows	Every related API pair (buy→use)	Can I skip Step