{"id":51429477,"url":"https://github.com/bnomei/devana","last_synced_at":"2026-07-05T03:02:04.792Z","repository":{"id":367272728,"uuid":"1279593771","full_name":"bnomei/devana","owner":"bnomei","description":"Skill to hunt for bugs manually or with goal/loop/schedule","archived":false,"fork":false,"pushed_at":"2026-06-25T09:03:47.000Z","size":19,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-25T10:15:51.491Z","etag":null,"topics":["ai-agents","bug","bug-finding","bug-hunting","code-quality","dataflow-analysis","devana","developer-tools","goal","hunt","loop","runtime-bugs","schedule","security-analysis","semantic-analysis","skills","skills-sh","software-quality","static-analysis"],"latest_commit_sha":null,"homepage":"https://www.skills.sh/bnomei/devana","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bnomei.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":"bnomei","buy_me_a_coffee":"bnomei"}},"created_at":"2026-06-24T20:46:51.000Z","updated_at":"2026-06-25T09:47:20.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/bnomei/devana","commit_stats":null,"previous_names":["bnomei/devana"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/bnomei/devana","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bnomei%2Fdevana","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bnomei%2Fdevana/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bnomei%2Fdevana/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bnomei%2Fdevana/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bnomei","download_url":"https://codeload.github.com/bnomei/devana/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bnomei%2Fdevana/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35141966,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-05T02:00:06.290Z","response_time":100,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-agents","bug","bug-finding","bug-hunting","code-quality","dataflow-analysis","devana","developer-tools","goal","hunt","loop","runtime-bugs","schedule","security-analysis","semantic-analysis","skills","skills-sh","software-quality","static-analysis"],"created_at":"2026-07-05T03:02:03.892Z","updated_at":"2026-07-05T03:02:04.777Z","avatar_url":"https://github.com/bnomei.png","language":null,"funding_links":["https://github.com/sponsors/bnomei","https://buymeacoffee.com/bnomei","https://www.buymeacoffee.com/bnomei"],"categories":[],"sub_categories":[],"readme":"# Devana\n\n[![skills.sh](https://skills.sh/b/bnomei/devana)](https://skills.sh/bnomei/devana)\n[![GitHub Release](https://img.shields.io/github/v/release/bnomei/devana?label=release)](https://github.com/bnomei/devana/releases)\n[![GitHub Downloads](https://img.shields.io/github/downloads/bnomei/devana/total?label=downloads)](https://github.com/bnomei/devana/releases)\n[![License](https://img.shields.io/github/license/bnomei/devana)](https://github.com/bnomei/devana/blob/main/LICENSE)\n[![Discord](https://flat.badgen.net/badge/discord/bnomei?color=7289da\u0026icon=discord\u0026label)](https://discordapp.com/users/bnomei)\n[![Buymecoffee](https://flat.badgen.net/badge/icon/donate?icon=buymeacoffee\u0026color=FF813F\u0026label)](https://www.buymeacoffee.com/bnomei)\n\nDevana is an agent skill for static semantic bug hunts. Use `devana-bug-hunt`\nwhen you want an agent to inspect source code for reachable runtime defects, not\nwhen you want a normal code review.\n\nDevana focuses on contracts, invariants, authority boundaries, state changes,\ndataflow, persistence, and failure paths. It rejects style feedback, lint output,\narchitecture opinions, missing-test comments, and generic cleanup suggestions.\n\n## Install\n\nInstall the latest release ZIP:\n\n[Download `devana.zip`](https://github.com/bnomei/devana/releases/latest/download/devana.zip)\n\nOr install with Skills.sh:\n\n```bash\nnpx skills add bnomei/devana --skill devana-bug-hunt\n```\n\n## Quickstart\n\nUse this when you want the current repository inspected now.\n\n### Prerequisites\n\n- Devana is installed in your agent host.\n- You are in the repository you want to inspect.\n- The agent can read the repository source files.\n\n### Run a one-shot hunt\n\nIn Codex:\n\n```text\nUse $devana-bug-hunt on this project.\n```\n\nIn Claude Code:\n\n```text\nUse /devana-bug-hunt on this project.\n```\n\nExpected result:\n\n```text\nreports written: 0\nstop reason: no actionable findings\n```\n\nIf Devana finds a reportable bug, it writes one or more Markdown reports under\n`.devana/` and prints the filenames before it stops.\n\nEvery finished hunt reports the number of reports written, any report filenames,\nand the stop reason.\n\n## What Devana reports\n\nDevana writes a report only when it can show all of these:\n\n- a specific affected location\n- a realistic runtime path\n- a violated invariant, contract, state transition, trust boundary, or failure\n  path expectation\n- a concrete counterexample\n- source-backed proof and counterevidence checked\n- the strongest false-positive reason checked\n- user, data, security, availability, or correctness impact\n- no obvious duplicate\n\nDevana prefers zero reports over noisy reports. It does not run tests, builds,\npackage installs, migrations, services, or network calls during a hunt.\n\n## Report files\n\nReports are durable Markdown records under `.devana/`:\n\n```text\n.devana/YYYYMMDDTHHMMSSZ-PN-short-slug.md\n```\n\nUse UTC when possible. Keep the slug lowercase ASCII, hyphen-separated, and\nunder eight words.\n\nEach report includes:\n\n- `DEVANA-FINDING`, `DEVANA-STATE`, and `DEVANA-KEY` header lines\n- the affected location, priority, confidence, and security marker\n- the violated invariant or contract\n- the oracle Devana used as source evidence\n- a counterexample and proof shape\n- counterevidence checked\n- a suggested next step\n- deterministic trailing `DEVANA-KEY` and `DEVANA-SUMMARY` lines\n\nSee the [report template](skills/devana-bug-hunt/references/report-template.md)\nfor the exact format.\n\n## Work a report\n\nAfter Devana writes a report, hand that single file to your normal coding agent:\n\n```text\nPlease work this Devana report: .devana/YYYYMMDDTHHMMSSZ-PN-short-slug.md\nValidate it against the current code, fix it if it is still valid, and update the report status.\n```\n\nThe agent should read the whole report, inspect the current code, and then either\nfix the bug or mark the report as `fixed`, `invalid`, `stale`, `duplicate`, or\n`wontfix`.\n\nWhen updating a report:\n\n- preserve line 1 and the original finding body\n- update line 2, `DEVANA-STATE: ...`\n- update the final `DEVANA-SUMMARY:` status, priority, and confidence prefix\n- keep both `DEVANA-KEY` values stable unless the same finding moved\n- add dated notes under `## Status Notes`\n- mark `fixed` only after the original counterexample is blocked\n\n## Priority reference\n\nPriority means human review urgency.\n\n| Priority | Use it for |\n| --- | --- |\n| `P0` | Sensitive, private, or catastrophic bugs, including reachable security, privacy, data loss, auth, tenant isolation, injection, RCE, path traversal, or secret exposure issues. |\n| `P1` | Likely serious bugs, such as important workflow breakage, persisted inconsistency, high-confidence crashes, or skipped billing, publishing, sync, permission, or cleanup behavior. |\n| `P2` | Plausible actionable bugs with concrete proof but uncertain impact. |\n| `P3` | Minor or uncertain runtime concerns that are still actionable. Devana should not emit `P3` for vague suspicion. |\n\n## Trail reference\n\nTrails are hunt lenses. Valid command arguments are empty, `--all`, or one or\nmore trail slugs. Empty invocation means all trails are available, but the hunt\nis not exhaustive. `--all` means Devana must actively cover all nine trails\nbefore it stops. Unknown tokens stop the run and list the valid trails.\n\n```text\n/devana-bug-hunt\n/devana-bug-hunt inside-out-paths\n/devana-bug-hunt boundaries-oracles\n/devana-bug-hunt inside-out-paths dataflow-boundaries\n/devana-bug-hunt --all\n```\n\n| Trail | Use it to inspect |\n| --- | --- |\n| `inside-out-paths` | Core functions, handlers, reducers, parsers, state machines, jobs, and state-changing methods. |\n| `outside-in-entrypoints` | Routes, CLI commands, consumers, scheduled jobs, webhooks, UI actions, public APIs, SDK methods, and plugin hooks. |\n| `invariants-contracts` | Docs, schemas, tests, callers, and callees for fields, units, optionality, ordering, ownership, errors, idempotency, and returns. |\n| `boundaries-oracles` | Empty, zero, one, min/max, duplicate, reordered, missing, null, expired, cancelled, retried, and just-outside values. |\n| `dataflow-boundaries` | Input and state as they move through transforms to sinks, including trust labels such as tenant, owner, actor, locale, version, and permission. |\n| `state-lifecycle` | Initialization, transitions, cleanup, retries, cancellation, concurrency, subscriptions, timers, workers, sessions, locks, and disposal. |\n| `contracts-errors` | Adapters, implementations, request and response shapes, return values, errors, nullability, timeouts, and partial failures. |\n| `cache-persistence` | Cache keys, canonicalization, tenant/user/locale/version dimensions, invalidation, transactions, stale reads, and background jobs. |\n| `security-boundaries` | Auth, ownership, tenant or project scoping, paths, injection, secrets, deserialization, and unsafe policy fallbacks. |\n\nWhen subagents are available, Devana may send one Arrow per trail. Arrows return\ncandidates only and must not write reports; lead Devana validates, deduplicates,\nprioritizes, and writes reports.\n\n## Scheduled hunts\n\nUse an automation or loop when you want recurring background checks.\n\nCodex automation prompt:\n\n```text\nUse $devana-bug-hunt on this project.\n```\n\nClaude Code loop:\n\n```text\n/loop Use /devana-bug-hunt on this project.\n```\n\n## Source files\n\n- [Skill definition](skills/devana-bug-hunt/SKILL.md)\n- [Report template](skills/devana-bug-hunt/references/report-template.md)\n- [Trail playbook](skills/devana-bug-hunt/references/trail-playbook.md)\n- [OpenAI agent metadata](skills/devana-bug-hunt/agents/openai.yaml)\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbnomei%2Fdevana","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbnomei%2Fdevana","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbnomei%2Fdevana/lists"}