Repo Bug Finder

Purpose

Find more real Bugs by giving the LLM the densest useful code surface, then labeling evidence strength honestly. This skill is discovery-only: it builds profiles, probes, context packs, triage records, and readiness data. Final Bug records and HTML reports belong to the package subskill.

Core Principle

Scripts retrieve facts; the LLM judges semantics. Do not grow a large hard-coded vulnerability library. Use scripts to expose repository shape, entry points, risky primitives, siblings, and local context, then ask the LLM to plan repo-specific probes from that profile.

Discovery is mode-driven. The agent must not stay in the same discovery mode for more than two consecutive rounds unless that mode yields a new confirmed/probable finding family. Grep, optional local Semgrep-compatible scanning, context packs, and direct reads are tools inside modes, not modes by themselves.

Semgrep is an optional third-party local CLI accelerator, not a dependency. Use only local semgrep scan with skill-owned rules when it is already installed and allowed by the user's policy. Do not require Semgrep, do not log in, do not use Semgrep AppSec Platform, semgrep ci, Registry rules, Pro rules, managed policies, or result upload. If Semgrep is unavailable or inappropriate, continue with grep/Python AST fallback and Deep Flow analysis.

Methodology Contract

The required discovery method is now a three-layer state machine: