mcpField
F
footgun-scan

footgun-scan

github.com/maxrave-devTesting & quality1.7k89 installsUpdated 1w ago
Repository

About footgun-scan

footgun-scan is a command-line skill for developers who want to inspect changes in a Git repository for code patterns associated with known pitfalls. Its Python script matches 32 detectors and directs users to the corresponding trap guidance; hits require manual review rather than being treated as confirmed bugs.

Key features

  1. 01Scans added lines for 32 patterns
  2. 02Supports working-tree and branch comparisons
  3. 03Audits selected paths
  4. 04Can exit nonzero on likely hits
  5. 05Links detections to trap guidance

Use cases

  1. 01Reviewing uncommitted changes
  2. 02Scanning a branch against its target
  3. 03Auditing selected source paths
  4. 04Adding a likely-hit check to CI

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/maxrave-dev/kotlin-footguns --skill footgun-scan

After installing, type/footgun-scanin Claude Code to confirm it loaded.

Bundled filesscripts/scan.py

Details

From the project README

Footgun scan

scripts/scan.py matches 32 patterns against the lines a change adds. Each pattern is tied to one trap file in the kotlin-footguns area skills. It finds shapes, not bugs: every hit needs the trap's judgment before it becomes a finding.

Run it

From inside the user's git repository, with this skill's base directory as <skill>:

python3 <skill>/scripts/scan.py                     # lines added in the working tree and index since HEAD
python3 <skill>/scripts/scan.py --base origin/main  # lines added on this branch since it left main
python3 <skill>/scripts/scan.py --all src/          # every line under a path: an audit, and noisier

Pick the scope from the request. Uncommitted work takes the default. A branch or pull request takes --base with its target branch. "Audit the codebase" takes --all, narrowed to the paths that matter. For a pre-commit hook or CI step, add --fail to exit 1 on any likely hit.

Triage every hit

  1. Read the trap file the hit points to (the -> path).
  2. Read the code around the hit and decide, by the trap's own conditions, whether it applies. A likely hit is wrong unless the exception the trap names holds. A look hit is a place the trap says to inspect before trusting it.
  3. Report each confirmed problem with the trap's fix and its Verifying step. List dismissed hits one line each with the reason, for example "column is NOT NULL" or "the fade goes to black".

Hits of one detector in one file are grouped: triage the group once, then check the listed lines for exceptions.

When the scanner cannot run

It needs python3 and git. Without them, read scripts/scan.py: the DETECTORS list gives each pattern, its message and its trap. Run those patterns with the Grep tool over the changed files and triage the same way.

Comments

Markdown supported