An automated pull-request audit and fix loop that repeatedly checks code, applies fixes, and uses GitHub reviews until the work converges or reaches its audit limit.

Use it to audit and repair a pull request, address code-quality and standards issues, and coordinate checks from multiple reviewers.

It removes the need to manually repeat audits, fixes, and review checks across a pull request. It also applies repository coding rules during the process.

bugteam — Skill by jl-cmd

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/jl-cmd/claude-dev-env/bugteam

Any agent

npx skills add jl-cmd/claude-dev-env --skill bugteam

Clone the repo

git clone --depth 1 https://github.com/jl-cmd/claude-dev-env

Made for: Claude Code, Codex.

Per session 110 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,031 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00110	$0.02031
Opus 5	$0.00055	$0.01015
Sonnet 5	$0.00022	$0.00406
Haiku 4.5	$0.00011	$0.00203

Measured 2d ago against content hash 3a314fe65e7e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

bugteam scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 16 executable files (scripts/bugteam_code_rules_gate.py, scripts/bugteam_fix_hookspath.py, scripts/bugteam_preflight.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/claude-dev-env/.agents/skills-archived/bugteam/SKILL.md · 144 lines

How it starts

The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Bugteam

Audit–fix until convergence. Bugfind: code-quality-agent, fresh process or fresh agent context each loop, auditing all A–Q categories via the worker-spawn dispatcher. Bugfix and standards-fix: clean-coder via the same dispatcher (role clean-coder; tier 2 pins model opus). Hard cap: 20 audit loops. Grant .claude/** at start, revoke always at end.

The audit agent loads the A–Q category rubrics from $HOME/.claude/audit-rubrics/{category_rubrics,prompts}/ alongside PROMPTS.md and produces a single outcome XML per loop.

Transport check (before any GitHub step)

Run command -v gh; when it succeeds, run gh auth status; once the PR scope is resolved, run gh api repos/<owner>/<repo> --jq .permissions.push and take true as the pass. When any check fails, run the pr-loop-cloud-transport skill first and route every gh operation in this skill through its substitution matrix.

Judgment guides

Use the review guide to decide whether a changed behavior is a finding. Use the comment guide for posted findings and replies, the description guide for final PR context, the emergency guide for active incidents, and the small-change guide when the diff needs a narrower review boundary.

Pre-flight

python "${CLAUDE_SKILL_DIR}/scripts/bugteam_preflight.py"

Auto-remediation runs automatically when core.hooksPath is the failing check; other failures require manual fix before Step 0. Full detail: reference/team-setup.md § Pre-flight.

Refusals

First match wins; respond with the quoted line exactly and stop:

Disabled via environment. When CLAUDE_REVIEWS_DISABLED contains the token bugteam (comma-separated, case-insensitive, whitespace-tolerant): /bugteam is disabled via CLAUDE_REVIEWS_DISABLED. The pre-flight script also exits 7 in this case so any caller invoking it directly halts on the same signal. Gate semantics live in the reviewer-gates skill (../reviewer-gates/SKILL.md).
No PR or upstream diff. No PR or upstream diff. /bugteam needs a target.
Dirty tree. Uncommitted changes detected. Stash, commit, or revert before /bugteam.
Missing subagents (tier 2 only). Before a tier-2 Agent-tool spawn, confirm code-quality-agent and clean-coder exist. Else: Required subagent type <name> not installed. /bugteam needs both code-quality-agent and clean-coder available. Headless tiers rely on the preflight's agent-definition-file check instead.

Read the full file on GitHub · 144 lines

Files

What ships with it

53 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 144 lines · 110 tokens per session scan A 3a314fe65e7e

Subscribe to this mod's changes

bugteam is a skill published in the GitHub repository jl-cmd/claude-dev-env (6 stars, last pushed 2d ago), licensed MIT. It adds 110 tokens to every session and 2,031 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review Debugging

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

brainstorming

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

obra/superpowers · 37 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

agent-host-chat-contributions

Build and review cross-cutting agent-host chat behavior through lifecycle contributions. Use when adding turn lifecycle side effects, prompt or context injection, restored-history transformation, protocol-action observation, or when reviewing changes that add code to AgentSideEffects or AgentService.

microsoft/vscode · 56 tokens

auto-perf-optimize

Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.

microsoft/vscode · 62 tokens