不要运行清单。先拆解项目，然后彻底核实每个实体。

基于一个艰难的教训：一个项目用了21轮，用通用检查表找到172个漏洞。事后分析显示，先构建项目特定的检查矩阵，大多数漏洞在3-4轮内就能抓到。

清单的问题

通用检查表可以捕捉“已知模式”的漏洞（如CORS、XSS、时区）。但大多数关键漏洞是项目特定的逻辑漏洞：

• buy API 接受 cost=0 → 免费购买（不在任何清单中）
• raid-result 可调用而无需调用 buy →无限资金漏洞
• 搜索完成无法验证远程→掠夺的距离

这些漏洞存在于API之间的关系中，而非单个代码模式。

解决方案：解剖→验证→补充剂

六桌

🔍 Bug Audit Skill

Don’t run a checklist. Dissect the project, then exhaustively verify every entity.

Built from a hard lesson: a project took 21 rounds to find 172 bugs using generic checklists. Post-mortem revealed that building project-specific check matrices first would have caught most bugs in 3-4 rounds.

The Problem with Checklists

Generic checklists catch “known pattern” bugs (CORS, XSS, timezone). But most critical bugs are project-specific logic vulnerabilities:

• buy API accepts cost=0 → free purchases (not in any checklist)
• raid-result callable without calling buy first → infinite money exploit
• Search completion doesn’t verify distance → remote looting

These bugs live in the relationships between APIs, not in individual code patterns.

The Solution: Dissect → Verify → Supplement

Phase 1: Dissect — Read code, build 6 project-specific tables (10-15 min)
Phase 2: Verify  — Exhaustively check every row in every table
Phase 3: Supplement — Run generic modules as safety net
Phase 4: Regress — Check fixes didn't introduce new bugs
Phase 5: Archive — Record pitfalls for next audit

The 6 Tables

Data Flows table is the most critical. The biggest bugs (buy bypass, missing raid tokens) hide in the links between APIs.

Install

clawhub install bug-audit

Or manually:

git clone https://github.com/abczsl520/bug-audit-skill.git ~/.openclaw/skills/bug-audit

Then say: “对这个项目执行bug排查” or “audit this project for bugs”

What’s Inside

Documentation

Full docs on the Wiki:

• 解剖流程详解 — How to build each table, what to ask