Borrowing it
Nothing to install: this file belongs to go-to-k/cdkd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/go-to-k/cdkd/main/.claude/skills/hunt-bugs/SKILL.mdgit clone --depth 1 https://github.com/go-to-k/cdkdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/go-to-k/cdkd/hunt-bugs)<a href="https://agentmods.dev/skills/go-to-k/cdkd/hunt-bugs"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/hunt-bugs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/go-to-k/cdkd/hunt-bugs"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/hunt-bugs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.02275 |
| Opus 5.5 | $0.00025 | $0.00910 |
| Sonnet 5.5 | $0.00012 | $0.00455 |
| Haiku 4.5 | $0.00006 | $0.00228 |
Grade A, and why
hunt-bugs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 164 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cdkd Bug Hunt
Find latent cdkd bugs the way real users hit them: write a small CDK app using a resource / config / CFn notation cdkd has not exercised yet, deploy it to real AWS, and watch what breaks — on deploy AND destroy. Reading the source finds suspected bugs; deploying finds real ones. Exploratory and possibly expensive, acceptable only because every deployed resource is destroyed and verified gone ("Cleanup is non-negotiable" below).
Core principles
- Many-people-hit beats niche. Prioritize daily CDK patterns (S3→Lambda
notifications,
BucketDeployment, LambdalogRetention,AwsCustomResource,LambdaRestApi, adding a GSI / changing a property on redeploy,grant*IAM, cross-stack refs) over exotic edge cases. - UPDATE and DESTROY are where bugs hide. CREATE usually works; the high-value paths are redeploy-with-a-changed-property (replacement classification, silent drops) and delete (custom-resource onDelete, ordering, state cleanup). Always test an update and always run destroy.
- Check coverage first — hunt in genuinely-uncovered territory:
grep -rln "BucketDeployment\|addEventNotification\|logRetention\|AwsCustomResource\|LambdaRestApi\|NodejsFunction" tests/integration/ - Parallelize, but cap at ~4-5 in flight. One CDK app, several stacks.
Pre-synth once, then deploy from the assembly — parallel deploys that
each re-synth collide on the shared
cdk.outlock.npx cdk synth --all -qonce, thennode dist/cli.js deploy <Stack> -a /tmp/cdkd-bughunt/cdk.out ...per stack. (Without-a, deploy serially.)
Workflow
1. Pick targets
Use the area hint, else 3-5 common-but-untested patterns. Favor cheap, fast resources (S3 / SSM / IAM / Lambda / DynamoDB / SNS / SQS / Logs / Events / API GW); run slow ones (RDS / ElastiCache / CloudFront) sparingly.
2. Scaffold a throwaway app
vp run build first (the CLI runs from dist/). One CDK app under
/tmp/cdkd-bughunt/, one stack per pattern, names prefixed CdkdBughunt<Pattern>.
pnpm install --ignore-workspace, then npx cdk synth --all -q. State
bucket: cdkd-state-$(aws sts get-caller-identity --query Account --output text).
Record every stack you are about to deploy into the bug-hunt sentinel
(this arms the cleanup gate):
.claude/skills/hunt-bugs/bughunt-track.sh add CdkdBughuntS3Notify CdkdBughuntBucketDeploy ...
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -5 lines 2e8dcfbade6f
- 1mo ago Changed 1960eff1d613
- 1mo ago Changed · -7 lines e6ab1bb73055
- 1mo ago Changed · -13 lines scan C → A c142ddf7d31a
- 1mo ago Changed · +3 lines 9317734737c7
- 1mo ago Changed · +2 lines 6fcb5bb74d48
- 1mo ago Changed · -66 lines 1766d0a051e3
- 1mo ago Changed · +13 lines 68c7e54326e6
- 2mo ago First seen · 237 lines · 62 tokens per session scan C e98e29747b0b
hunt-bugs is a skill published in the GitHub repository go-to-k/cdkd (156 stars, last pushed today), licensed Apache-2.0. It adds 62 tokens to every session and 2,275 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tdd
Test-Driven Development workflow for ALL Prowler components (UI, SDK, API). Trigger: ALWAYS when implementing features, fixing bugs, or refactoring - regardless of component. This is a MANDATORY workflow, not optional.
ak-test
Set up testing and debug common issues in Agent Kernel projects. This skill guides you through configuring the built-in test framework, writing agent tests, choosing test modes (score, llm, fallback), and troubleshooting common errors.
finfocus-routing
Configure and debug FinFocus intelligent plugin routing. Use when setting up multi-plugin routing, configuring priority and fallback rules, writing pattern matching for resource types, testing route selection, or debugging why a plugin isn't receiving cost queries. Triggers on: "configure routing", "plugin priority"…
testing-patterns
Skill "testing-patterns" from seandkendall/kiro-config, covering testing patterns, python lambda test (pytest + moto), react component test (vitest + rtl), coverage commands and playwright quick reference.
aws-cdk-mcp-server-mcp
AWS Cloud Development Kit (CDK) best practices, infrastructure as code patterns, and security compliance with CDK Nag.
aws-testing
Testing strategies for AWS workloads. Use when writing unit tests, integration tests, contract tests, mocking AWS services, or setting up quality gates and CI/CD test pipelines.