SkillsAdd

milkywayrules/verasic-skills

verasic-bugbot

Bugbot-like local code review. Use when the user asks to "review changes", "bugbot review", "check my diff", "find bugs in my changes", or after completing a significant code change and wanting verification before commit/PR.

First seen Jul 18, 2026

Installation

$ npx skills add milkywayrules/verasic-skills --skill verasic-bugbot
View on skills.sh ↗ GitHub repository ↗

Also in this package

Other skills from milkywayrules/verasic-skills · top by installs.

npx skills add milkywayrules/verasic-skills
verasic-init 29 verasic-fusion 28 verasic-deep-research 24 verasic-git-commits 21 verasic-github-env 17 verasic-github-governance 14 verasic-github-governance-init 14 verasic-agent-disclosure 14 verasic-git-commits-audit 12 verasic-git-commits-convention 11

Browse all from milkywayrules/verasic-skills

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Default branch main
Open issues 0
Status Active

Skill metadata

Parsed from SKILL.md frontmatter.

Declared agents cursor

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 3,243 B
  • docs README.md 2,999 B
  • docs SUMMARY.md 246 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 33 installs

SKILL.md

Security: see references/scanner-notes.md and upstream SECURITY.md for expected scanner signals and trust model.

Verasic Bugbot — Local Review Orchestration

Workflow

  1. Determine scope from the user's message: branch changes (default) or uncommitted changes. A narrower user request (e.g. "only the API layer") filters which findings to report — the diff scope stays one of the two above.
  2. In Cursor: launch the verasic-bugbot-reviewer subagent (.cursor/agents/verasic-bugbot-reviewer.md) with the repository path and scope, in the foreground, then relay its report unchanged except strip harness paths, skill/rule names, protocol dumps, and internal config per verasic-agent-disclosure.
  3. After relay: if the diff touches auth, crypto, webhooks, or user-input validation, add one cross-tip line to /verasic-secbot for STRIDE depth. Never auto-chain.
  4. In any agent without subagents: read references/review-protocol.md and execute the review yourself in this conversation, following it exactly.

Orchestration (Cursor)

Run a Bugbot-like review of local changes.

Launch the verasic-bugbot-reviewer subagent with this prompt:

Full Repository Path: <current workspace root>
Diff: branch changes (use 'uncommitted changes' if I said so in my message)
Follow your system prompt fully: read full files, trace callers, apply the checklists in .cursor/skills/verasic-bugbot/checklists/ (or .agents/skills/verasic-bugbot/checklists/ for cursor-hybrid installs), filter aggressively, and report in your standard output format.

After the subagent returns, relay its findings verbatim — do not soften severities or drop issues. If it found zero issues, say so plainly.

Bugbot-only — use /verasic-secbot for STRIDE security depth.

After the summary, if the diff touches auth, crypto, webhooks, or user-input validation, add ONE line: Tip: auth/crypto/webhook/input changes — run /verasic-secbot for STRIDE depth.

Source of truth

The full review protocol (diff scope, process, filtering, output format) lives in references/review-protocol.md. The Cursor subagent is a thin pointer to it; never duplicate the protocol elsewhere.

Checklists (used by the protocol)

Modular checklists live in checklists/:

  • checklists/correctness.md — logic, edge cases, contracts, concurrency
  • checklists/security.md — injection, secrets, authz, unsafe deserialization
  • checklists/performance.md — N+1, unbounded growth, blocking calls
  • checklists/infra.md — Docker/compose/CI/proxy: exposed ports, secrets, data loss

Add project-specific checklists as new files here; the protocol applies every .md file in checklists/.

Hard rules

  • Never review without reading full files — hunks lie.
  • Never report style/nitpicks. Real bugs only.
  • Zero findings is a valid result; report it confidently.