{"repo":"abczsl520/bug-audit-skill","free":true,"listed":false,"github":"https://github.com/abczsl520/bug-audit-skill","clone":"git clone https://github.com/abczsl520/bug-audit-skill.git","description":"OpenClaw skill: Dynamic bug audit for Node.js web projects (games, data tools, WeChat, APIs, bots). 200+ real-world pitfalls.","language":null,"stars":20,"topics":["ai-agent","automation","bug-detection","clawhub","code-review","nodejs","openclaw","quality-assurance","security-audit","skill"],"license":null,"category":"workflow-automation","readme_excerpt":"🔍 Bug Audit Skill Don't run a checklist. Dissect the project, then exhaustively verify every entity. Built from a hard lesson: a project took 21 rounds to find 172 bugs using generic checklists. Post-mortem revealed that building project-specific check matrices first would have caught most bugs in 3-4 rounds . The Problem with Checklists Generic checklists catch \"known pattern\" bugs (CORS, XSS, timezone). But most critical bugs are project-specific logic vulnerabilities : - buy API accepts cost=0 → free purchases (not in any checklist) - raid-result callable without calling buy first → infinite money exploit - Search completion doesn't verify distance → remote looting These bugs live in the relationships between APIs , not in individual code patterns. The Solution: Dissect → Verify → Supplement The 6 Tables Table Extracts Key Question ------- ---------- ------------- API Endpoints Every route: method, path, auth, params Can I bypass? What if I send garbage? State Machines Every state variable: setter, reader, lifecycle Does it leak across lifecycles? Timers Every setTimeout/setInterval Does it fire after cleanup? Numeric Values Every user-influenceable number What if 0? Negative? Huge? Data Flows Every related API pair (buy→use) Can I skip Step 1 and call Step 2 directly? Resource Ledger Every resource: all inflows, all outflows Is there an infinite loop? Data Flows table is the most critical. The biggest bugs (buy bypass, missing raid tokens) hide in the links between APIs.","default_branch":null,"files":null,"tree":[],"storefront":"/r/abczsl520","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/abczsl520/bug-audit-skill/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}