bug-audit

What This Skill Does

The bug-audit skill for OpenClaw is a sophisticated diagnostic tool designed specifically for Node.js web projects. Unlike traditional static analysis tools that rely on generic, one-size-fits-all checklists, bug-audit performs a deep-dive, contextual dissection of your codebase. It builds a project-specific knowledge graph by extracting six critical structural categories: API Endpoints, State Machines, Timers, Numeric Values, Data Flows, and Resource Ledgers. By systematically analyzing the relationships between these elements, the tool identifies complex logic flaws that automated scanners typically miss, such as race conditions, state leakage, and insecure sequential transaction flows.

Installation

To integrate this skill into your OpenClaw environment, execute the following command in your terminal: clawhub install openclaw/skills/skills/abczsl520/bug-audit

Use Cases

This skill is ideal for security-conscious developers, QA engineers, and system architects. It excels in environments where business logic complexity is high, such as:

• Gaming Backends: Checking for state persistence bugs, loot manipulation, and race conditions in event loops.
• Fintech APIs: Verifying the atomicity of multi-step transaction flows and ensuring data integrity.
• WeChat Mini Programs: Auditing cross-lifecycle state management and input validation.
• Real-time Dashboards: Ensuring timers and resource management do not lead to memory leaks or stale data state issues.

Example Prompts

1. "I'm worried about the checkout flow in my Node.js backend. Please run a bug-audit to see if users can skip the payment step while still getting the digital items."
2. "Perform a security review on my game server code. I need to ensure that numeric values like damage and xp cannot be manipulated by the client."
3. "Can you audit the API endpoints for my dashboard project? I suspect some internal IDs might be leaking in the response objects."

Tips & Limitations

The bug-audit skill performs its best work when the project structure follows standard Node.js patterns. It requires read access to your codebase to build its internal matrices. For the most accurate results, ensure your project is clean and free of excessive obfuscation. Remember that this tool is an assistant; while it is exceptional at finding structural flaws, human oversight remains vital for final architectural decisions. Because it performs an exhaustive analysis, large codebases may require the full 15-minute dissection period.