Borrowing it
Nothing to install: this file belongs to go-to-k/cdkd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/go-to-k/cdkd/main/.claude/skills/hunt-bugs/SKILL.mdgit clone --depth 1 https://github.com/go-to-k/cdkdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/go-to-k/cdkd/hunt-bugs)<a href="https://agentmods.dev/skills/go-to-k/cdkd/hunt-bugs"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/hunt-bugs.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.02669 |
| Opus 5 | $0.00031 | $0.01334 |
| Sonnet 5 | $0.00012 | $0.00534 |
| Haiku 4.5 | $0.00006 | $0.00267 |
Grade C, and why
hunt-bugs scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
`pip install` / `npm i` / `curl | sh` any of it — read only the comment body Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`pip install` / `npm i` / `curl | sh` any of it — read only the comment body How it starts
The opening of the file, as written. The whole thing — 186 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cdkd Bug Hunt
Find latent cdkd bugs the way real users hit them: write a small CDK app that uses a resource / config / CFn notation cdkd has not exercised yet, deploy it to real AWS, and watch what breaks — on deploy AND destroy. Reading the source finds suspected bugs; deploying finds real ones. Exploratory and possibly expensive — acceptable only because every deployed resource is destroyed and verified gone ("Cleanup is non-negotiable" below, enforced by a markgate gate).
Core principles
- Many-people-hit beats niche. Prioritize daily CDK patterns (S3→Lambda
notifications,
BucketDeployment, LambdalogRetention,AwsCustomResource,LambdaRestApi, adding a GSI / changing a property on redeploy,grant*IAM, cross-stack refs) over exotic edge cases. - UPDATE and DESTROY are where bugs hide. CREATE usually works; the high-value paths are redeploy-with-a-changed-property (replacement classification, silent drops) and delete (custom-resource onDelete, ordering, state cleanup). Always test an update and always run destroy.
- Check coverage first — hunt in genuinely-uncovered territory:
grep -rln "BucketDeployment\|addEventNotification\|logRetention\|AwsCustomResource\|LambdaRestApi\|NodejsFunction" tests/integration/ - Parallelize, but cap at ~4-5 in flight. One CDK app, several stacks.
Pre-synth once, then deploy from the assembly — parallel deploys that
each re-synth collide on the shared
cdk.outlock.npx cdk synth --all -qonce, thennode dist/cli.js deploy <Stack> -a /tmp/cdkd-bughunt/cdk.out ...per stack. (Without-a, deploy serially.)
Workflow
1. Pick targets
Use the area hint, else 3-5 common-but-untested patterns. Favor cheap, fast resources (S3 / SSM / IAM / Lambda / DynamoDB / SNS / SQS / Logs / Events / API GW); run slow ones (RDS / ElastiCache / CloudFront) sparingly.
2. Scaffold a throwaway app
vp run build first (the CLI runs from dist/). One CDK app under
/tmp/cdkd-bughunt/, one stack per pattern, names prefixed CdkdBughunt<Pattern>.
pnpm install --ignore-workspace, then npx cdk synth --all -q. State
bucket: cdkd-state-$(aws sts get-caller-identity --query Account --output text).
Record every stack you are about to deploy into the bug-hunt sentinel
(this arms the cleanup gate):
.claude/skills/hunt-bugs/bughunt-track.sh add CdkdBughuntS3Notify CdkdBughuntBucketDeploy ...
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +2 lines 6fcb5bb74d48
- 4d ago Changed · -66 lines 1766d0a051e3
- 6d ago Changed · +13 lines 68c7e54326e6
- 8d ago First seen · 237 lines · 62 tokens per session scan C e98e29747b0b
hunt-bugs is a skill published in the GitHub repository go-to-k/cdkd (137 stars, last pushed today), licensed Apache-2.0. It adds 62 tokens to every session and 2,669 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tdd
Test-Driven Development workflow for ALL Prowler components (UI, SDK, API). Trigger: ALWAYS when implementing features, fixing bugs, or refactoring - regardless of component. This is a MANDATORY workflow, not optional.
ak-test
Set up testing and debug common issues in Agent Kernel projects. This skill guides you through configuring the built-in test framework, writing agent tests, choosing test modes (score, llm, fallback), and troubleshooting common errors.
finfocus-routing
Configure and debug FinFocus intelligent plugin routing. Use when setting up multi-plugin routing, configuring priority and fallback rules, writing pattern matching for resource types, testing route selection, or debugging why a plugin isn't receiving cost queries. Triggers on: "configure routing", "plugin priority"…
aws-cdk-mcp-server-mcp
AWS Cloud Development Kit (CDK) best practices, infrastructure as code patterns, and security compliance with CDK Nag.
aws-testing
Testing strategies for AWS workloads. Use when writing unit tests, integration tests, contract tests, mocking AWS services, or setting up quality gates and CI/CD test pipelines.
python-runtime
Python toolchain configuration and best practices. Use when setting up Ruff, pytest, mypy type hints, dependency management, virtual environments or Python project standards.