Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dentiny/kon/bug-huntnpx skills add dentiny/kon --skill bug-huntgit clone --depth 1 https://github.com/dentiny/konWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dentiny/kon/bug-hunt)<a href="https://agentmods.dev/skills/dentiny/kon/bug-hunt"><img src="https://agentmods.dev/badge/skills/dentiny/kon/bug-hunt.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.00996 |
| Opus 5 | $0.00022 | $0.00498 |
| Sonnet 5 | $0.00009 | $0.00199 |
| Haiku 4.5 | $0.00004 | $0.00100 |
Grade A, and why
bug-hunt scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Hunt
Owner: 🎸 Azusa
Consumers: /kon:hunt
Core principles (always): follow skills/core-principles — first principles (don't hide the issue); simplest, most concise correct solution.
Static bug analysis from the codebase. Read-only — no file edits, no fixes, no mutating shell. Output includes best-effort repro SQL and test/command suggestions the user can run themselves.
When to use
| User wants | Command |
|---|---|
| Analyze a bug from code, suggest repro | /kon:hunt |
| How does X work? | /kon:ask |
| Fix a bug (repro + patch + review) | /kon:debug |
Read-only hard floor
Same as /kon:ask — zero repo writes.
| Action | Allowed? |
|---|---|
| Read / Glob / Grep source | ✅ |
Read-only git (log, diff, show, status) |
✅ |
Run read-only inspection commands (cat, python3 -c print-only) |
✅ |
| Run tests that mutate repo / create caches | ❌ (suggest command only) |
| Write / edit project files | ❌ |
Write session artifact hunt.md under ~/.kon/ |
✅ (hook or orchestrator) |
git commit / git push / checkout / reset |
❌ |
Analysis rules
- Evidence first — every claim cites
path:lineor command output you read - Confidence labels — root cause:
high|medium|low|unknown - Unknown stays unknown — no invented behavior or file paths
- No fixes — optional "fix direction" bullets only; no patches or edits
- Best-effort repro — SQL/tests/commands are hypotheses; label assumptions
Output artifact
Follow templates/bug-report.md — user intake at top, analysis from Code trace down. Persist to sessions/<session-id>/hunt.md.
Repro guidelines (best-effort)
SQL
- Only when the bug involves queries, schema, or data shape
- Prefix with schema/table assumptions:
-- assumes: users(id), orders(user_id) - Prefer minimal
SELECT/EXPLAINthat would expose the bug - Mark:
**Best-effort repro SQL** — verify table/column names against your schema
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 121 lines · 43 tokens per session scan A 45257f817978
bug-hunt is a skill published in the GitHub repository dentiny/kon (3 stars, last pushed 1mo ago), licensed MIT. It adds 43 tokens to every session and 996 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
schema-exploration
Lists tables, describes columns and data types, identifies foreign key relationships, and maps entity relationships in a database. Use when the user asks about database schema, table structure, column types, what tables exist, ERD, foreign keys, or how entities relate.
agent-platform-rag-engine-management
Manage and query Agent Platform RAG Engine Corpora and retrieve grounded contexts using the Google GenAI SDK. Use when listing RAG corpora or files, inspecting a corpus, retrieving contexts, or generating content grounded in a RAG corpus. Do not use for standard database queries (use SQL/Spanner skills), Google…
moderator-page-migration
Port a moderator page from the main Next.js app (src/pages/moderator/) into apps/moderator. Use when asked to migrate, move or cut over a /moderator/ page to the spoke, or to port its tRPC procedures and Prisma services to SvelteKit loads/actions and Kysely.
dsql
Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, diagnose cluster performance, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK…
sql-translate
Translate SQL queries between database dialects (Snowflake, BigQuery, PostgreSQL, MySQL, etc.).
cwicr-material-procurement
Generate material procurement lists from CWICR data. Calculate quantities with waste factors, group by supplier categories, and create purchase orders.