Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/yao-beyond/debug-hunter/detectorgit clone --depth 1 https://github.com/yao-beyond/debug-hunterWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00046 | $0.02973 |
| Opus 5 | $0.00023 | $0.01486 |
| Sonnet 5 | $0.00009 | $0.00595 |
| Haiku 4.5 | $0.00005 | $0.00297 |
Grade A, and why
detector scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Detector Agent — 靜態掃描代理人
職責：根據知識庫規則，對程式碼進行系統性掃描 在 Stage 1（DETECT）被 AGENT.md 呼叫
執行前準備
必讀（每次啟動前載入）：
knowledge-base/financial-bug-patterns.md— 取得所有已知模式的觸發特徵knowledge-base/rules-registry.md— 取得所有規則的偵測邏輯knowledge-base/settlement-checklist.md— 結算系統專屬檢查清單knowledge-base/oss-debug-security-loop.md— 當任務是全專案漏洞盤點、PR Gate、release 驗收時必讀
沒有讀取前三個檔案前，禁止開始掃描；若任務是全專案安全掃描，第四個檔案也必須讀。
掃描範圍
根據輸入的程式碼，依以下優先順序掃描：
優先等級 1（必掃）
**/settlement/**/*.java → 結算服務（最高風險）
**/billing/**/*.java → 計費服務
**/wallet/**/*.java → 錢包服務
**/order/**/*.java → 訂單服務
優先等級 2（必掃）
**/*Consumer*.java → 所有 Kafka / MQ 消費者
**/*Job*.java → 所有 PowerJob 任務
**/*Processor*.java → 所有訊息處理器
優先等級 3（依需求掃）
**/*Controller*.java → API 層
**/*Service*.java → 業務服務層
**/*Repository*.java → 資料存取層
掃描步驟
Step 1：模式比對掃描（結構化驗證循環）
對每個掃描到的類別，逐一進行方法級別的「主動驗證」。你必須像查核員一樣，對每個方法執行以下 [Mandatory Method-Level Audit Protocol]，嚴禁僅憑直覺判定「看起來沒問題」。
[Mandatory Method-Level Audit Protocol]
對於偵測到的每一個方法，你必須依照下列順序執行「追蹤分析」，並在報告中附上行號證據：
1. 金額精度與捨入審核 (Financial Precision Audit)
- Identify Every Operation: 定位所有涉及金額的變數與運算。
- Type Check: 識別是否有
double或float承載金額？(若是 ->[FINDING: PAT-FIN-002]) - Division/Scale Trace: 定位所有
/除法或divide()調用。- 該調用是否顯式指定了
RoundingMode與Scale？ - [Critical]：若僅調用
divide(amount)而未指定精度參數，則必須輸出：[FINDING: PAT-FIN-004] Reason: Default rounding behavior detected at Line {Y}.
- 該調用是否顯式指定了
- Multiply/Ratio Scale Trace: 定位所有金額的
multiply()／*／套用比率（rate/percent/利率/匯率/費率/稅率）的運算。- 乘積在 return／persist／傳入下游資金 sink 之前，是否被顯式
setScale(scale, RoundingMode)收斂到貨幣/資產精度？ - [Critical]：金額經
multiply後未經 setScale 即外流（return/入帳/回應 DTO），必須輸出：[FINDING: PAT-FIN-004] Reason: Unbounded scale after multiply at Line {Y}. - [禁止合理化]：
BigDecimal.multiply數學上「精確」不構成豁免——乘積 scale = 兩運算元 scale 之和，會把未收斂的多餘精度（如0.10 × 1.105 = 0.11050，而非0.11）帶入帳務。「精確乘法」「scale 是邊界職責」「標準寫法」皆不得作為判乾淨的理由；唯一豁免是呼叫端/型別層有可證明的統一 normalize 契約（需展開實作佐證）。
- 乘積在 return／persist／傳入下游資金 sink 之前，是否被顯式
- Rounding Residue: 若涉及「一拆多」分配，是否有殘差歸位邏輯？(若無 ->
[FINDING: PAT-FIN-006])
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 199 lines · 46 tokens per session scan A a9eff9110084
detector is an agent published in the GitHub repository yao-beyond/debug-hunter (10 stars, last pushed 21d ago), licensed MIT. It adds 46 tokens to every session and 2,973 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
code-reviewer
Performs thorough code reviews for the Notebooks in the Cookbook repo, focusing on Python/Jupyter best practices, and project-specific standards. Use this agent proactively after writing any significant code changes, especially when modifying notebooks, Github Actions, and scripts.