hotfix

hotfix is a command for Claude Code from xiaobei930/cc-best. It costs 20 tokens per session (845 once invoked), scanned A, original, MIT.

An emergency software-fix workflow that moves directly from development to verification and Git commit, skipping the usual planning and design stages.

In plain words
What is it for?
Use it for urgent fixes such as a server error or cross-site scripting vulnerability, with a deliberately small change and related tests.
Why use it?
It shortens the path for production bugs and security patches that need a quick response. The workflow still includes building, type checking, linting, tests, security scanning, and progress updates.

Command for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: names the TodoWrite tool.

Part of the cc-best plugin — 19 skills, 44 commands, 8 agents, 20 hooks shipped together

Good fit Use it for urgent fixes such as a server error or cross-site scripting vulnerability, with a deliberately small change and related tests.

Compare 6 commands from other repositories ↓
Install with agentmods
npx agentmods add commands/xiaobei930/cc-best/hotfix
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/xiaobei930/cc-best

Made for: Claude Code.

Or install cc-best, the plugin that ships this one along with the rest of its 19 skills, 44 commands, 8 agents, 20 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for hotfix

README.md
[![agentmods](https://agentmods.dev/badge/commands/xiaobei930/cc-best/hotfix/github.svg)](https://agentmods.dev/commands/xiaobei930/cc-best/hotfix)
Your own site
<a href="https://agentmods.dev/commands/xiaobei930/cc-best/hotfix"><img src="https://agentmods.dev/badge/commands/xiaobei930/cc-best/hotfix/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for hotfix

Your own site · 80×15
<a href="https://agentmods.dev/commands/xiaobei930/cc-best/hotfix"><img src="https://agentmods.dev/badge/commands/xiaobei930/cc-best/hotfix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 20 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 845 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00020 $0.00845
Opus 5.5 $0.00008 $0.00338
Sonnet 5.5 $0.00004 $0.00169
Haiku 4.5 $0.00002 $0.00085

Measured 1mo ago against content hash 283a5976f971, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

hotfix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/hotfix.md · 105 lines

How it starts

The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/hotfix - 紧急修复快速通道

跳过完整管线(PM→Lead→Designer→Dev→QA),直接进入 Dev→Verify→Commit 流程。

适用于生产环境的紧急 Bug 修复、安全补丁等需要快速响应的场景。


使用方式

# 描述修复内容
/cc-best:hotfix "修复登录接口 500 错误"
/cc-best:hotfix "修复 XSS 漏洞"

# 无参数 - 从 progress.md 读取当前紧急任务
/cc-best:hotfix

执行流程

┌─────────────────────────────────────────┐
│           Hotfix 快速通道                │
├─────────────────────────────────────────┤
│                                          │
│  读取 progress.md                        │
│         ↓                                │
│  /cc-best:dev  ─── 编码修复              │
│         ↓                                │
│  /cc-best:verify ─ 构建+类型+Lint+测试   │
│         ↓                                │
│  /cc-best:commit ─ 提交变更              │
│         ↓                                │
│  更新 progress.md                        │
│                                          │
└─────────────────────────────────────────┘

Step 1: 确认修复内容

  • 如果提供了描述参数 → 直接使用
  • 如果无参数 → 读取 memory-bank/progress.md 中标记为紧急的任务
  • 在 progress.md 中记录 hotfix 开始

Step 2: 编码修复

执行 /cc-best:dev:

  • 专注于最小化修复,不做额外重构
  • 修改范围尽可能小
  • 添加或更新相关测试用例

Step 3: 验证

执行 /cc-best:verify:

  • 构建检查
  • 类型检查
  • Lint 检查
  • 测试运行
  • 安全扫描

Step 4: 提交

执行 /cc-best:commit:

  • Commit message 使用 fix: 前缀
  • 更新 memory-bank/progress.md

与完整管线的区别

对比项 完整管线 (/cc-best:iterate full) Hotfix (/cc-best:hotfix)
需求分析 PM 角色执行 跳过
技术设计 Lead 角色执行 跳过
UI 设计 Designer 角色执行 跳过
编码 Dev 角色执行 Dev 角色执行
验证 Verify 执行 Verify 执行
QA 验收 QA 角色执行 跳过
提交 Commit 执行 Commit 执行

注意事项

  • Hotfix 适用于 紧急修复,不适合新功能开发
  • 修复范围应尽可能小,避免引入新问题
  • 完成后建议在下次迭代中补充完整的 QA 验收
  • 如果修复涉及架构变更,应使用完整管线
  • 安全类修复建议调用 security-reviewer agent 审查修复代码
  • 构建失败可调用 build-error-resolver agent 快速定位问题

Read the full file on GitHub · 105 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 105 lines · 20 tokens per session scan A 283a5976f971

Subscribe to this mod's changes

hotfix is a command published in the GitHub repository xiaobei930/cc-best (48 stars, last pushed 4mo ago), licensed MIT. It adds 20 tokens to every session and 845 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.