Bug Audit Skill

🔍 Bug Audit Skill

[](https://clawhub.com) [](LICENSE) [](https://github.com/openclaw/openclaw)

Don't run a checklist. Dissect the project, then exhaustively verify every entity.

Built from a hard lesson: a project took **21 rounds** to find 172 bugs using generic checklists. Post-mortem revealed that building project-specific check matrices first would have caught most bugs in **3-4 rounds**.

The Problem with Checklists

Generic checklists catch "known pattern" bugs (CORS, XSS, timezone). But most critical bugs are **project-specific logic vulnerabilities**:

• buy API accepts cost=0 → free purchases (not in any checklist)
• raid-result callable without calling buy first → infinite money exploit
• Search completion doesn't verify distance → remote looting

These bugs live in the **relationships between APIs**, not in individual code patterns.

The Solution: Dissect → Verify → Supplement

Phase 1: Dissect — Read code, build 6 project-specific tables (10-15 min)
Phase 2: Verify  — Exhaustively check every row in every table
Phase 3: Supplement — Run generic modules as safety net
Phase 4: Regress — Check fixes didn't introduce new bugs
Phase 5: Archive — Record pitfalls for next audit

The 6 Tables

Table	Extracts	Key Question
API Endpoints	Every route: method, path, auth, params	Can I bypass? What if I send garbage?
State Machines	Every state variable: setter, reader, lifecycle	Does it leak across lifecycles?
Timers	Every setTimeout/setInterval	Does it fire after cleanup?
Numeric Values	Every user-influenceable number	What if 0? Negative? Huge?
Data Flows	Every related API pair (buy→use)	Can I skip Step