Doc Lookup

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 206587dd9725 · 16 Oct 2026Report an issue or request a re-scan

• Publishercodexstar69 GitHub userOwner of the repository this skill is read from
• Source foldercodexstar69/bug-hunter/skills/doc-lookupThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict206587dd9725A new audit runs when the source changes
• Repository statusNot archivedLast push 60 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Unified documentation lookup for Bug Hunter agents. Uses Context Hub (chub) as primary source with Context7 API fallback. Provides verified library/framework documentation to prevent false positives and ensure correct…

---
name: doc-lookup
description: "Unified documentation lookup for Bug Hunter agents. Uses Context Hub (chub) as primary source with Context7 API fallback. Provides verified library/framework documentation to prevent false positives and ensure correct fix patterns."
---

# Doc Lookup — Verified Documentation Access

## Documentation Lookup (Context Hub + Context7 fallback)

When you need to verify a claim about how a library, framework, or API actually behaves — do NOT guess from training data. Look it up.

### When to use this

- "This framework includes X protection by default" — verify it
- "This ORM parameterizes queries automatically" — verify it
- "This function validates input" — verify it
- "The docs say to do X" — verify it
- Any claim about library behavior that affects your bug verdict

### How to use it

`SKILL_DIR` is injected by the orchestrator. Use it for all helper script paths.

The lookup script tries **Context Hub (chub)** first for curated, versioned docs, then falls back to **Context7** when chub doesn't have the library.

**Step 1: Search for the library**
```bash
node "$SKILL_DIR/scripts/doc-lookup.cjs" search "<library>" "<what you need to know>"
```
Example: `node "$SKILL_DIR/scripts/doc-lookup.cjs" search "prisma" "SQL injection parameterized queries"`

This returns results from both sources with a `recommended_source` and `recommended_id`.

**Step 2: Fetch documentation**
```bash
node "$SKILL_DIR/scripts/doc-lookup.cjs" get "<library-or-id>" "<specific question>"
```
Example: `node "$SKILL_DIR/scripts/doc-lookup.cjs" get "prisma/orm" "are raw queries parameterized by default"`

This fetches curated docs from chub if available, otherwise Context7 documentation snippets with code examples.

**Optional flags:**
- `--lang js|py` — language variant (for chub docs with multiple languages)
- `--source chub|context7` — force a specific source

### Rules

- Only look up docs when you have a SPECIFIC claim to verify. Do not speculatively fetch docs for every library in the codebase.
- One lookup per claim. Don't chain 5 searches — pick the most impactful one.
- If the API fails or returns nothing useful, say so explicitly: "Could not verify from docs — proceeding based on code analysis."
- Cite what you found: "Per Express docs: [quote]" or "Prisma docs confirm that $queryRaw uses parameterized queries."

Excerpt, first 2,364 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/codexstar69/bug-hunter
git -C bug-hunter checkout 206587dd9725

Works in

1. 2026-10-16
   ✓SAFE B 89 / 100

   first audit · source 206587dd9725

Questions about Doc Lookup

• github.com/codexstar69/bug-hunter/tree/main/skills/doc-lookup — the audited source at commit 206587dd9725 and every finding aboveObserved · 16 Oct 2026

Spotted something wrong? Report a correction · Methodology