Use when the user types /sniff, or asks to "scan this project for bugs", "find bugs in my app", "QA my site", or "walk my app and tell me what's broken". For a running web app, finds real, reproducible issues (broken pages/links, console & network errors, broken forms, empty/placeholder data, state-loss, bad loading/error states, responsive and accessibility problems), each with reproduction proof, severity, confidence, and a fix. No API key needed.
Pro scans all 13 files and shows the line behind each finding
Scanned 9/21/2026
Skills Directorynpx -y skills add NeverSight/skills_feed --skill sniff --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Sniff?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/neversight-sniff)More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.
---
name: sniff
description: Use when the user types /sniff, or asks to "scan this project for bugs", "find bugs in my app", "QA my site", or "walk my app and tell me what's broken". For a running web app, finds real, reproducible issues (broken pages/links, console & network errors, broken forms, empty/placeholder data, state-loss, bad loading/error states, responsive and accessibility problems), each with reproduction proof, severity, confidence, and a fix. No API key needed.
---
# /sniff: find real bugs in this project
## What to do
1. Call the unified `sniff` MCP tool with:
- `mode`: `"walk"`, the autonomous flow-walk that drives a real browser and finds runtime bugs (this is the one that matters; `"scan"` is source-only)
- `rootDir`: the current project's absolute path
- omit `baseUrl` to auto-detect the running dev server, or pass it if the user gives a URL
2. If the response is `{ needsSetup: "playwright-browsers" }`, call the `sniff_install` tool, then retry the walk.
3. If no app is running, sniff returns a note + a source-only scan. Tell the user to start their dev server (or pass a URL) for the full flow-walk that finds the real runtime bugs.
4. Present findings grouped by severity (CRITICAL and HIGH first). For each, show the **route**, the **reproduction steps**, the **confidence** (confirmed / likely / uncertain), and the **suggested fix**. Mention any finding marked `needsOutOfBandVerification` (e.g. "submitted but no success shown, confirm the email/job actually ran"). Offer `/sniff-fix` for the safe, auto-fixable ones.
## Example
```
User: /sniff
You: Walking your running app for real bugs…
[calls sniff with mode="walk", rootDir=/Users/user/projects/my-app]
Found 9 real issues (0 false positives) across 12 pages:
**Critical (1)**
- /checkout: Page returns HTTP 500 (crash screen shown to the user)
**High (3)**
- /: Broken link → /pricing-old (HTTP 404)
- /dashboard: Uncaught exception: cannot read 'map' of undefined
- /signup: Submit button does nothing (no request, no message, no change)
**Medium (5)**
- /orders: Empty table with no empty-state ("Your Orders")
- /profile: Placeholder data shipped (test@test.com)
- …each with reproduction steps + a screenshot + a fix.
Want me to fix the safe ones with /sniff-fix?
```
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
