bug-corpus

Converts confirmed bugs into permanent deterministic static detectors enforced in CI.

1|Updated Sep 10, 2026
One-click install
npx skills add https://github.com/carterlasalle/bugcorpus --skill bug-corpus-carterlasalle
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: bug-corpus
Source: https://github.com/carterlasalle/bugcorpus/tree/main/.agents/skills/bug-corpus
Command: npx skills add https://github.com/carterlasalle/bugcorpus --skill bug-corpus-carterlasalle

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Fixed bugs often regress because a one-off test is the only guard. This Skill turns every confirmed bug into a structured BugCase with a minimized reproducer, a stated invariant, and a deterministic detector (Semgrep, CodeQL, Pysa, ast-grep, or a regression test) that runs in CI without an LLM, so the same bug class is caught automatically forever. ## Core Features & Use Cases - Bug-to-detector pipeline: Capture a confirmed fix with bugcorpus learn, state symptom vs root cause vs invariant, then synthesize a detector on the cheapest adequate engine. - Fixture-driven verification: Every detector ships positive, negative, and adversarial fixtures; bugcorpus verify enforces recall and zero false positives before promotion from shadow to blocking. - Community exchange: Export, publish, and install portable detector bundles with fixtures and provenance via bugcorpus community commands. - Use Case: After fixing an async race condition, run the workflow to generate a Semgrep rule with adversarial fixtures, promote it to blocking, and let CI reject any future instance of that bug class. ## Quick Start After fixing a bug, ask the agent to run the bug-corpus workflow to learn the fix, synthesize a detector, verify it against fixtures, and promote it to blocking in CI.

Frequently Asked Questions about bug-corpus

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I turn a bug fix into a static analysis rule?

Fix the bug and prove it with normal tests, then run `uv run bugcorpus learn` to capture evidence. State the symptom, root cause, and violated invariant, then run `bugcorpus synthesize` to pick the cheapest adequate engine and `bugcorpus verify` to check fixtures.

Which static analysis engine should I use for a bug detector?

Use the cheapest adequate engine from the ladder: existing tools like ruff, mypy, or pytest first, then lexical, ast-grep, Semgrep, Semgrep taint, CodeQL, Pysa, and finally a custom AST analyzer. The `synthesize` command ranks engines automatically.

When should a detector be promoted to blocking in CI?

Promote to blocking only when the detector achieves 100% positive fixture recall, zero negative false positives, and meets the adversarial recall threshold in `.bugcorpus/config.toml`. New detectors always start in shadow mode and `bugcorpus promote --auto` advances eligible ones.

What if no static rule can express my bug?

Record rung 0: the pytest regression test itself becomes the detector. Set `source: regression-test` and `detector_status: tested` on the BugCase so the fix still closes the loop without faking a static manifest.

What kinds of bugs should not be added to the corpus?

Do not learn typos, formatting issues, dependency bumps, or style opinions. Also avoid creating entries from heuristics alone, since auto-generated proposed drafts carry no invariant until an agent refines them.