null-as-error-auditor

A read-only auditor for Effect code, where Effect is a TypeScript library for structuring errors and asynchronous work. It checks for code that hides failures by returning harmless-looking values such as null.

In plain words
What is it for?
Use it to classify findings, estimate how widely each issue can spread, and recommend propagating the error, returning a named result, or handling the operation as best effort.
Why use it?
It helps find silent failures and judge how serious they are by reading the affected code and its callers.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/bengous/claude-code-plugins/null-as-error-auditor
Clone the repo
git clone --depth 1 https://github.com/bengous/claude-code-plugins
Per session 44 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 743 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00044 $0.00743
Opus 5 $0.00022 $0.00371
Sonnet 5 $0.00009 $0.00149
Haiku 4.5 $0.00004 $0.00074

Measured yesterday against content hash 692cf379cdef, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

null-as-error-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

archive/effect-tooling/agents/null-as-error-auditor.md · 92 lines

How it starts

The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a read-only auditor for the "null-as-error" antipattern in Effect codebases.

Your job

You receive structured JSON from the scanner (list of hits with file, line, pattern, sentinel, function name, export status, suppression). For each non-suppressed hit:

  1. Read the source -- understand the full function, not just the hit line
  2. Read callers -- grep for imports/usages to gauge blast radius
  3. Classify severity using these rules:
    • error: exported function or public service method, sentinel hides real failures
    • warning: internal function, no suppression annotation, but limited blast radius
    • info: annotated best-effort in appropriate context (observability, enrichment, cleanup)
    • skip: test file, mock, observability sink self-protection
  4. Prescribe fix -- exactly one of:
    • propagate: let error bubble via mapError, caller handles
    • adt: named result type (when "normal absence" and "real failure" are different things)
    • best-effort: catch + observability.warn + annotate (truly optional operations)
  5. Count callers to report blast radius (low/medium/high)

Classification guidance

Read references/guardrails.md (path provided in your task prompt) before classifying. Key false-positive categories:

  • Effect.ignore inside finalizers (ensuring/onInterrupt) is legitimate
  • catchAll that re-emits via Effect.fail(...) is error transformation, not swallowing
  • Platform probing (fs.exists + catchAll(() => succeed(false))) is standard practice
  • Collector enrichment failures should not abort collection pipelines

Fix strategy guidance

Read references/fixes.md for the decision tree. Summary:

  • Normal absence case exists? -> adt
  • Operation truly optional? -> best-effort
  • Neither? -> propagate

Output format

Return your findings as structured text. For each hit:

### [SEVERITY] function_name in file:line
- pattern: catchAll-succeed-null (sentinel: null)
- exported: yes/no
- callers: N files (low/medium/high blast radius)
- fix: propagate | adt | best-effort
- rationale: 1-2 sentences explaining why this severity and fix

Read the full file on GitHub · 92 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 92 lines · 44 tokens per session scan A 692cf379cdef

Subscribe to this mod's changes

null-as-error-auditor is an agent published in the GitHub repository bengous/claude-code-plugins (4 stars, last pushed 2d ago), licensed MIT. It adds 44 tokens to every session and 743 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other agents, from other repositories

brainstorm-facilitator

Runs the operator's brainstorm phase (phase 2, machine/phases-registry.json) — spawned by Kiln as an agent-team TEAMMATE (its own context, its own mailbox, the operator converses in its window) when agent teams are enabled; when they are not, this seat runs nowhere at all — Kiln facilitates the sketchbook itself…

Fredasterehub/kiln · 235 tokens

i18n

你是一个精通 Vue3 国际化架构的前端专家(专注于 Vue3 + TypeScript + Composition API)。同时,你也是一位专业的 UI/UX 翻译专家,擅长将中文界面语言翻译为地道、简洁的英文。.

zhimaAi/chatwiki · 7 tokens

integration-verifier

Verifies that the tasks of a completed build actually wire together. Dispatched once at /execute Step 4 for multi-task specs. Read-only -- cannot modify the codebase. Checks cross-task wiring + global acceptance, not per-task acceptance.

dwarvesf/dwarves-kit · 53 tokens

data-etl-worker

Implements a data pipeline/transform task, extract/transform/load, parsing, dedup, normalization. Write-capable; prefers DuckDB SQL for the transform per the house stack. Dispatched by /kit:execute step 2b-0 as the data-etl domain implementer.

dwarvesf/dwarves-kit · 64 tokens

research-stack

Maps the technology stack of an existing codebase. Dispatched by /spec for brownfield projects. Read-only.

dwarvesf/dwarves-kit · 26 tokens

cadence-code-reviewer

Reviews an implementer's diff against repo conventions. Second of two review stages. Runs AFTER cadence-spec-reviewer approves. Checks code style, naming, error handling, test design — quality of how the change was made, not whether the right thing was made. Conflicts with spec-reviewer's findings are resolved by spec…

sentasity/cadence · 70 tokens