Skip to content
Back to skills

Demo 2 Bug Hunt

BSecurity

Demo skill that hunts two seeded bugs in a tiny stats package until its tests go green, then files a detective-style CASE_FILE.md with the evidence.

  • 613 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 8, 2026
ai-agentsgo

Security analysis

B85/100
  • highPerforms destructive filesystem operations

Pro scans all 3 files and shows the line behind each finding

Scanned October 8, 2026

npx -y skills add decodingai-magazine/building-a-coding-agent-from-scratch-course --skill demo-2-bug-hunt --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Demo 2 Bug Hunt?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Demo 2 Bug Hunt
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/decodingai-magazine-demo-2-bug-hunt/badge)](https://www.skillsdirectory.com/skills/decodingai-magazine-demo-2-bug-hunt)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: demo-2-bug-hunt
description: Demo skill that hunts two seeded bugs in a tiny stats package until its tests go green, then files a detective-style CASE_FILE.md with the evidence.
---

Play detective on a small statistics package: reproduce the failures, hunt down the bugs, fix
them until every test passes, and file a case report.

## Setup

1. Copy the seeded project into a working directory you own (fresh — delete a stale one first):
   `rm -rf .decode/outputs/bug-hunt && mkdir -p .decode/outputs && cp -r .decode/skills/demo-2-bug-hunt/references/buggy_repo .decode/outputs/bug-hunt`
2. Change into it and run the suite to see the failures:
   `cd .decode/outputs/bug-hunt/ && uv run pytest -q`
3. **Save the crime scene**: keep the exact failing-test output — the failure names and the
   expected-vs-actual values — you will quote it in the case file at the end.

Exactly two tests fail as committed — one in `median`, one in `variance`. Do NOT edit the tests;
they encode the correct behaviour. Fix `stats.py` instead.

## Hunt

Track the investigation with `todo_write` (reproduce → suspect A → suspect B → verify → case
file) and tick items off as you close them.

- Read `test_stats.py` to learn the contract each failing test asserts (the expected values are
  the spec).
- Read `stats.py` and locate the defect behind each failure with `grep`/`read`. The LSP
  diagnostics that surface on your edits will help you catch typos and type slips as you go.
- There are two independent bugs:
  - `median` returns the wrong element for odd-length inputs (an indexing off-by-one).
  - `variance` comes back with the wrong sign (it should never be negative).

## Fix and verify

1. Fix the root cause of each bug in `stats.py` — the smallest correct change, not a special case
   that only satisfies the one test input.
2. Re-run `uv run pytest -q` and confirm the whole suite is green. Keep that green one-liner too.

## File the case report

Write `.decode/outputs/bug-hunt/CASE_FILE.md` — short, punchy, detective-flavoured:

- **The symptoms** — the failing test names and the quoted expected-vs-actual output from setup
  step 3.
- **The culprits** — one section per bug: the guilty line (`stats.py:<line>`), the root cause in
  one sentence, and the before/after of the fixed line.
- **Case closed** — the quoted green `pytest -q` summary line proving the suite passes.

Report the two root causes, the one-line fix for each, and point the human at `CASE_FILE.md`.

Files in this skill

  • SKILL.md2.5 KB
  • references/buggy_repo/stats.py1.5 KB
  • references/buggy_repo/test_stats.py938 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.