agent-skills/skills/bug-class-detectors/SKILL.md

name	description	license	homepage	tested_with
bug-class-detectors	Find bug CLASSES, not instances. A pack of 37 root-cause detectors (hardcoded-universe, schema-by-name, units-mismatch, stale-config landmines, fail-open config, double-count metrics, swallowed-exceptions-around-writes, dead-backend, duplicate-file-divergence, clone-class, and more) that scan a codebase for whole categories of defects and emit CI auto-fix PRs. A Snyk/Sonar alternative focused on architectural bug classes. By Elite Agentic Solutions (EAS).	MIT	https://bugclass.eliteaiempire.com	claude-code v2.x

Bug-Class Detectors

Most static analyzers find bug instances — one null-deref, one injection. Bug-class detectors find the whole CLASS: every place the same root-cause pattern recurs, so fixing one fixes all and the class never regresses. This is the EAS BugClass engine (bugclass.eliteaiempire.com), distilled into a portable skill.

When to use

• Auditing an unfamiliar codebase for systemic defects (not lint noise).
• Before a refactor or a release gate — catch the category of bug.
• In CI — emit auto-fix PRs that close a class atomically.

The 37 detected classes

ID	Class	What it catches
C1	HARDCODED_UNIVERSE_LIST	A hardcoded universe/entity roster that silently drops a registered member when one is add
C2	SCHEMA_BY_NAME	A data source validated/dispatched by name without asserting its schema (column/field shap
C3	UNITS_MISMATCH	Money/quantity arithmetic (size_usd*price, qty by side) without an explicit unit/side corr
C4	STALE_PW_CONFIG_LANDMINE	An inline/hardcoded secret (systemd Environment=, literal pw) that diverges from the live
C5	FAIL_OPEN_NAIVE_CONFIG	A kill/arming/safety/feature gate whose backing store is missing/malformed and it defaults
C6	METRIC_CONFLATION_DOUBLE_COUNT	Aliased/duplicate universe identity in capital/PnL math (double-count source), or corrupt
C7	ROTATION_MISS	A long-lived consumer captures a secret at startup and never re-reads it after rotation.
C8	SWALLOWED_EXCEPTION_AROUND_WRITE	A bare/catch-all except swallows a redis/db/file WRITE with no logging -> silent data loss
F2613	UNIVERSE_FEE_FALLTHROUGH	A registry universe hits the generic ~2% fee fallback (silent mispricing); also peer share
F2614	DUPLICATE_FILE_DIVERGENCE	A filename present in two source trees (e.g. /root/scripts and /root/shared-components) ha
F2649a	METRIC_MISREAD_DENOMINATOR_DRIFT	A ratio is read against the wrong denominator (coverage_frac over ALL markets vs traded ma
F2649b	BUILT_BUT_DARK_PRODUCER	A producer is built + default-OFF but has NO systemd unit and NO arming trigger -> sits da
F2650	PERSONA_CLONE_CLASS	A signal-weight vector is byte-identical across >1 universe (same weights applied to diffe
F2654	DEAD_BACKEND	A backend (container, host:port, ssh tunnel, CH table) moved/died post-migration; writers/
F2602	STALE_CRED_INHERITED_ENV	Active file uses a stale HARDCODED pw as a live connection (or a stale inherited env) -> 4
F2665	SIGNAL_RACE_FOREIGN_WRITE	An owner recomputes+overwrites its namespace each cadence; a FOREIGN writer to the same ca
F2666	WRONG_ENGINE_WRONG_LAUNCHER	The launcher default engine/launcher mismatches the corpus/runtime shape (raw vs compacted
F2602b	LEAKED_TOKEN_IN_GIT_CONFIG	A credential (PAT/API token/password) embedded in a .git/config remote URL (https://user:T
F2681a	UNINITIALIZED_NAME	A name is used (Load) that is never bound in its scope and is not a builtin/import/global/
F2681b	WRONG_LAYER_EDIT	A two-layer file (canonical source vs a sync/build-mirrored COPY) is edited on the COPY si
F2681c	LOOKAHEAD_LEAK_DECISION_TIME_JOIN	A backtest/replay signal-injection path selects a time-series point with a NON-as-of acces
F2681d	LIVE_STATE_CLAIM_UNVERIFIED	A memory/handoff/report file asserts a service/URL/file is missing/broken/dead/404 (or a c
F2681e	WRONG_BOX_INVENTORY_CLAIM	A capability/data is checked on the WRONG host/path/box (hub when the feed is apps-box-own
F2686	PATCH_INJECTED_AT_WRONG_POSITION	An automated patch fragment is inserted at a position that breaks the module: a statement
F2687b	MISSING_TOOLING_SILENT_FALLBACK	A script/unit silently degrades when a tool/binary/import is absent: command -v X
F2688	VENUE_TYPE_ARCHETYPE_MISMATCH	A persona whose archetype class is structurally impossible for its universe venue_type (se
F2694	METRIC_MATURITY_CONFLATION	A monitoring/comparison reads an event-time-stamped table whose rows arrive with write-lag
F2694_REDIS_UNNAMED_CLIENT	Unnamed redis client (unix-socket caller un-attributable)	fc-redis unix-socket clients that never CLIENT SETNAME share addr=/tmp/fc-redis.sock:0 so
F2694_GITLAB_CIDR_DRIFT	GitLab webhook CIDR drift (silent auto-deploy break)	Hetzner fw rule 11082658 pins GitLab SaaS hook egress CIDRs (GCP us-east1 34.74.90.64/28+3
F2685_WRONGLAYER	WRONG_LAYER_EDIT_F2402_SYNC (detector v2)	Edits made ONLY to the apps-box copy of an F2402-enforced file are reverted by the hub->ap
F2711_FLAG_NAMESPACE_CONFLATION	FLAG_NAMESPACE_CONFLATION	A freshness-watched service idles/skips/early-exits its MAIN LOOP on a flag F that is ALSO
C9	HEARTBEAT_KEY_NAMESPACE_MISMATCH	A watchdog/monitor checks the freshness (get/ttl/exists) of a heartbeat key whose namespac
F228c_HEARTBEAT_KEY_DRIFT	HEARTBEAT_KEY_DRIFT_MANIFEST	Live/manifest variant: given watched_key + writer grep pattern, confirms the watched heart
CLONE_PERSONA	Cross-universe persona clone (byte-identical signal vector)	A persona signal-weight vector byte-identical across >1 universe, or carrying foreign-venu
VENUE_SIGNAL_MISMATCH	Foreign-venue / destroyer signal on a universe	A persona carries a signal structurally impossible for its venue_type (book-micro on binar
RETENTION_EATS_REPLAY_WINDOW	Offload/retention job re-darkens data a consumer is actively inflating	A retention/offload job (RETAIN_DAYS=4) and a long-window consumer (replay since-days=17)
F2765	HARDCODED_FALLBACK_CRED_IN_SOURCE	A real credential hardcoded as a string literal in source, typically as the fallback of an

How to run

1. Identify the language/stack and the highest-risk classes for it (config-driven systems → stale-config / fail-open; data pipelines → units-mismatch / double-count / schema-by-name; distributed systems → rotation-miss / swallowed-exception-around-write / dead-backend).
2. For each class, grep/AST-scan for the pattern signature (see class descriptions). Report every hit as CLASS_ID @ file:line with the minimal fix.
3. Cluster hits by class. Propose ONE architectural fix per class (not N point-fixes).
4. If in CI with write access, open a single PR per class that fixes all instances.

Output

A per-class findings table: class → instances → root cause → one fix that closes the class.

Upgrade

The full hosted engine (live CI integration, auto-fix PRs, dashboard, 100s of repos) is at https://bugclass.eliteaiempire.com — this skill is the open, portable detector logic.