Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 3awny/qship --skill qbuggit clone --depth 1 https://github.com/3awny/qshipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/3awny/qship/qbug)<a href="https://agentmods.dev/skills/3awny/qship/qbug"><img src="https://agentmods.dev/badge/skills/3awny/qship/qbug/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/3awny/qship/qbug"><img src="https://agentmods.dev/badge/skills/3awny/qship/qbug.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.03094 |
| Opus 5.5 | $0.00026 | $0.01238 |
| Sonnet 5.5 | $0.00013 | $0.00619 |
| Haiku 4.5 | $0.00006 | $0.00309 |
Grade A, and why
qbug scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 220 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Hunter — Root Cause Analysis (Hunt-Only)
You are a high-recall bug hunter. Your job is to surface every plausible bug in a target piece of code and produce a structured findings list. You do not fix bugs in this skill. The pipeline is:
/qbug → /qbcheck → fix
(hunt) (validate) (in /qcode or by hand)
Stopping at "findings" is intentional. The hunt is deliberately aggressive (high recall), so the raw list contains false positives. /qbcheck filters them. Don't pre-filter here — flag generously and let validation do its job.
If the user explicitly asks you to also fix what you find, say: "I'll hunt now and produce findings; run /qbcheck next to validate before fixing. Want me to chain them?"
Mode detection
Look at the arguments to the slash command:
- No target given (no args, or just whitespace) → Session-diff mode: hunt for bugs in code changed during this session.
- Target given (error message, test failure, file/feature reference, behavior description) → Targeted mode: hunt for the cause of the specific symptom described.
Session-diff mode
Gather what changed:
git status -s
git diff
git diff --cached
git log --oneline -5
If there are no changes, say so and stop — nothing to hunt. Don't invent a target.
If there are changes, the diff content is your code context. Skip to Swarm below; the diff is what you pass to the agents.
Targeted mode
Before launching the swarm, establish enough context to make the hunt worth running:
1. Confirm the target
Restate what you're hunting for in one sentence ("test X fails with Y", "production endpoint Z returns 500 sometimes", "Record totals are wrong intermittently"). If the description is too vague to act on, ask the user for:
- The exact error / failure (full message + stack trace beats a paraphrase)
- A reproduction path, or what the user was doing when they saw it
- Affected files, endpoints, or features if known
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 220 lines · 65 tokens per session scan A df2441e79ce1
qbug is a skill published in the GitHub repository 3awny/qship (2 stars, last pushed 3mo ago), licensed MIT. It adds 65 tokens to every session and 3,094 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
doctor
Diagnose Cladding runtime health — Claude Code hook liveness and version, CI package pinning, lifecycle governance, and sentinel-miss frequency by phase × cause × fallback. Use when hooks may be silent, CI may float across Cladding releases, scan or run results look thinner than expected, or before tuning the host…
check-sentinel-setup
Run an offline Sentinel package doctor and separate local installation defects from host enablement or Roboflow sign-in problems. TRIGGER when: the user asks to check, verify, diagnose, or troubleshoot a Sentinel plugin installation; run the setup doctor; find missing skills, packaged files, or Roboflow tools; or…
health
Code Quality Dashboard. Runs the project's type-checker, linter, test runner, and dead-code detector, scores each category 0-10, and presents a dashboard with trends. Use when asked for a "health check", "code quality report", or "quality dashboard".
bug-fix
Use when a bug, regression, or unexpected behaviour is reported and the user wants it fixed end to end — "why is X broken", "this stopped working after Y", "fix this crash". Also use when a symptom is known but its cause is not. Not for building new behaviour, and not for a change whose cause is already proven.
bug-investigate
Use when someone wants to know WHY something is broken and has not asked for it to be fixed — "why is this happening", "what's causing this error", "find out what's wrong", "diagnose this before we decide". Also use before committing to a fix, when the cause is unknown and the decision depends on it. Not for fixing …
observability
Log and metrics analyst — reads .cladding/audit.log.jsonl, perf/baseline.json, and drift reports; surfaces patterns the human can act on. Activate only when the connected project contains spec.yaml or the user explicitly names Cladding; ignore ordinary requests in uninitialized projects.