Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mtarcure/claude-vibe-squad --skill systematic-bug-huntinggit clone --depth 1 https://github.com/mtarcure/claude-vibe-squadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mtarcure/claude-vibe-squad/systematic-bug-hunting)<a href="https://agentmods.dev/skills/mtarcure/claude-vibe-squad/systematic-bug-hunting"><img src="https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/systematic-bug-hunting/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mtarcure/claude-vibe-squad/systematic-bug-hunting"><img src="https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/systematic-bug-hunting.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.07819 |
| Opus 5.5 | $0.00036 | $0.03128 |
| Sonnet 5.5 | $0.00018 | $0.01564 |
| Haiku 4.5 | $0.00009 | $0.00782 |
Grade A, and why
systematic-bug-hunting scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| P-07 | force a 500 whose body echoes the rendered template | any unauth POST to `/preview`; `tpl` param reaches the renderer | none | manual read `render.py:88` + curl repro | yes | RCE | How it starts
The opening of the file, as written. The whole thing — 477 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Systematic Bug Hunting
Phase numbering — three schemes exist, and they are NOT the same
Numeric phase references in this skill, in specialist briefs, in shared/modes/bounty.md, and in
scripts/python/verification_contract.py use different numbering. A reference like "Phase 3"
is ambiguous unless you know which scheme it belongs to. Resolve with this table before acting on any
numeric phase label:
| This skill (0–8) | What it actually is |
|---|---|
| Phase 0 | Scope lock, program truth, facts |
| Phase 1–2 | Prior-art exclusion, planning, measured index |
| Phase 3 / 3a / 3b | Hypothesis generation and hunting — 3b is invention |
| Phase 4 | Chaining / composition |
| Phase 5 | Proof, PoC, negative controls |
| Phase 6–7 | Impact bar, cross-family reproduction, skeptic |
| Phase 8 | Package, de-AI, operator submit gate |
The contract S-stage axis (S0–S7) is owned by scripts/python/verification_contract.py and is
not a parallel numbering of these phases — resolve a bare S-label against that file, not by lining
it up against this table.
The mode axis is owned by shared/modes/bounty.md (phases 0–7) and is not restated here — resolve
a bare mode "Phase N" against that file, lining it up through the What it actually is column.
When a packet and a document disagree on a phase number, the packet wins and you report the
conflict. Do not silently renumber, and do not assume "Phase 3" in a brief means the same stage as
"Phase 3" in the mode.
Overview
systematic-debugging guards the fix. systematic-attacking guards the claim and the
campaign. This skill guards the hunt — the bench work between "I have an authorized
target" and "I have a proven chain to hand back."
Hunting fails in two characteristic ways, and they are opposites:
- False positive — a quirk, a reachable sink, or a one-step primitive gets written up as a finding because it looks exploitable. Reachability dressed as impact.
- False negative — the hunter runs two tools, applies the known class list, finds nothing individually decisive, and reports "nothing here." The bug was there; the arsenal was not.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago First seen · 477 lines · 91 tokens per session scan A 8141e9e5c84a
systematic-bug-hunting is a skill published in the GitHub repository mtarcure/claude-vibe-squad (165 stars, last pushed 25d ago), licensed MIT. It adds 91 tokens to every session and 7,819 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-19.
Other skills, from other repositories
rust-check
Run cargo check on the current Rust project to find compile errors.
debug
Reproduce, minimize, localize, identify root cause, and distinguish diagnosis from an authorized fix. Prefer root-cause over symptom patches.
openrig-skills
Use when an agent running inside OpenRig needs the right skill or context for fleet recovery, seat handover, new-seat orientation, a watchdog wake, cross-host reach to an agent on another machine, rig packaging, an OpenRig upgrade, systematic debugging, queue triage, or implementation planning; also when the agent…
feedback
Skill "feedback" from Hmbown/Codewhale, covering feedback, when to use, setup, workflow and non-goals.
oversight-team
Use when you are a seat on the oversight pod (a standing monitor-mode rig that keeps OTHER rigs healthy), configuring or running the drift detectors, or choosing whether to intervene vs escalate. Covers the pull-not-poll posture, the v0 detectors (premature-park, process-drift, off-task, token-burn), the intervention…
developing-openrig
Use when changing OpenRig's own source in a clone of the openrig repository: finding which package or file owns a behaviour, choosing which tests to run, testing a change without disturbing the OpenRig daemon your own session runs on, judging whether a diff touches a high-risk area, or preparing a pull request. Not…