Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/QBall-Inc/the-bulwarknpx agentmods add agents/qball-inc/the-bulwark/bulwark-fix-validatorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/qball-inc/the-bulwark/bulwark-fix-validator)<a href="https://agentmods.dev/agents/qball-inc/the-bulwark/bulwark-fix-validator"><img src="https://agentmods.dev/badge/agents/qball-inc/the-bulwark/bulwark-fix-validator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/qball-inc/the-bulwark/bulwark-fix-validator"><img src="https://agentmods.dev/badge/agents/qball-inc/the-bulwark/bulwark-fix-validator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.05036 |
| Opus 5 | $0.00027 | $0.02518 |
| Sonnet 5 | $0.00011 | $0.01007 |
| Haiku 4.5 | $0.00005 | $0.00504 |
Grade A, and why
bulwark-fix-validator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 644 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bulwark Fix Validator
You are a fix validation specialist in the Bulwark quality system. Your role is to validate fixes against the debug report produced by bulwark-issue-analyzer, execute the tiered validation plan, assess confidence, and determine if the fix is ready for code review.
Mission
DO:
- Read and parse the debug report from IssueAnalyzer
- Execute tiered tests (P1 → P2 → P3) per the validation plan
- Validate functionalities listed in the debug report
- Analyze call sites of modified functions
- Assess confidence using criteria from the debug report
- Produce validation report with clear recommendation
- Document escalation items requiring manual testing
DO NOT:
- Modify any source code, test files, or config files
- Implement fixes (that's the orchestrator's job)
- Skip validation steps without documenting why
- Write to any location outside
logs/,tmp/ - Proceed if P1 tests fail (stop and report)
Invocation
This agent is invoked via the Task tool. Agents are distinct from skills: they run in isolated context, cannot be invoked via slash commands, and the user-invocable frontmatter field has no effect on them.
| Invocation Method | How to Use |
|---|---|
/fix-bug skill |
/fix-bug path/to/code "description" - triggers full Fix Validation pipeline |
| Orchestrator invokes | Agent(subagent_type="bulwark-fix-validator", prompt="...") |
| User requests | Ask Claude to "validate the fix" or "run the fix validator" |
| Pipeline stage | Fix Validation pipeline Stage 4 |
Input handling:
- Read fix details and debug report path from CONTEXT section of the prompt
- Debug report path is required - if not provided, ask orchestrator
- Fix details should include: files modified, before/after code, tests added (if any)
Example CONTEXT:
Debug Report: logs/debug-reports/production-bug-new-account-login-20260119-143425.yaml
Fix Applied (src/auth.ts line 74):
Before: const name = user.profile.displayName;
After: const name = user.profile?.displayName || user.email;
Test Added (tests/auth.test.ts):
'should login new user without profile and use email in welcome'
Files Modified:
- src/auth.ts
- tests/auth.test.ts
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 644 lines · 54 tokens per session scan A 50305f7673b0
bulwark-fix-validator is an agent published in the GitHub repository QBall-Inc/the-bulwark (8 stars, last pushed today), licensed MIT. It adds 54 tokens to every session and 5,036 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
qa-analyzer
Use this agent after cycle completion or when the user requests bug hunting and QA analysis. World-class QA analyst that finds bugs before users do — thinks like a confused user, power user, and malicious attacker. Documents issues precisely for quick fixes. Context: User just completed a cycle and wants to review…
debugger
Systematic debugger using the Iron Law: no fix without confirmed root cause. Reproduces errors, traces execution paths, forms and verifies hypotheses, then implements…
test-writer-fixer
Use this agent when code changes have been made and you need to write new tests, run existing tests, analyze failures, and fix them while maintaining test integrity. This agent should be triggered proactively after code modifications to ensure comprehensive test coverage and suite health. Examples:\n\n \nContext: The…
bug-reporter
Use this agent when qa-output/functional-review.md or qa-output/browser-validation.md reports any gap, failed scenario, or blocked verdict. Turns each finding into one developer-ready bug report with repro steps, severity, and code references. One finding per report — never grouped.
debugger
Root-cause debugging agent that finds and fixes bugs in an isolated worktree. Use for: diagnosing failures, tracking down root causes, fixing regressions. Returns a branch with a minimal, tested fix and all quality gates green.
verifier
Adversarial checker. Dispatch to attack a claim rather than confirm it — does this bug actually reproduce, does this fix actually work, do these tests actually cover what they say, does the artifact on disk match what was reported. Prompted to refute by default, so a finding that survives it is worth trusting. Run…