Borrowing it
Nothing to install: this file belongs to AlphaBitCore/nexus-gateway. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/AlphaBitCore/nexus-gateway/main/.claude/skills/frontend-bug-trace/SKILL.mdgit clone --depth 1 https://github.com/AlphaBitCore/nexus-gatewayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alphabitcore/nexus-gateway/frontend-bug-trace)<a href="https://agentmods.dev/skills/alphabitcore/nexus-gateway/frontend-bug-trace"><img src="https://agentmods.dev/badge/skills/alphabitcore/nexus-gateway/frontend-bug-trace/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alphabitcore/nexus-gateway/frontend-bug-trace"><img src="https://agentmods.dev/badge/skills/alphabitcore/nexus-gateway/frontend-bug-trace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 134 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium MCP Rug Pull · line 124 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Data Exfiltration · line 138 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium MCP Rug Pull · line 205 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.02124 |
| Opus 5.5 | $0.00018 | $0.00850 |
| Sonnet 5.5 | $0.00009 | $0.00425 |
| Haiku 4.5 | $0.00004 | $0.00212 |
Grade A, and why
frontend-bug-trace scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: Use when fixing frontend bugs, UI errors, runtime crashes, or data display issues — traces page to API to backend to database, fixes mismatches, then verifies via curl login + DB queries How it starts
The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Frontend Bug Trace
Full-stack bug tracing: Page -> Component -> API call -> Backend handler -> Database. Fix mismatches at every layer, then verify with real requests and DB queries.
Workflow
digraph trace {
rankdir=TB;
node [shape=box];
identify [label="1. Identify Page & Component\n(URL + error stack trace)"];
trace_api [label="2. Trace API Calls\n(find service file + useApi hooks)"];
compare [label="3. Compare Frontend Types vs Backend Response\n(field names, types, nullability)"];
check_backend [label="4. Check Backend Handler\n(SQL, field mapping, JSON tags)"];
fix [label="5. Fix All Mismatches\n(backend fields, frontend types, null guards)"];
build [label="6. Build Verification\n(go build + tsc)"];
verify_api [label="7. Verify: curl login + call API\n(check response shape)"];
verify_db [label="8. Verify: DB query via Docker\n(cross-check data)"];
done [label="9. Report to user"];
identify -> trace_api -> compare -> check_backend -> fix -> build -> verify_api -> verify_db -> done;
}
Step 1: Identify Page & Component
From the URL or error stack trace, locate the page component using route files first (not global search):
URL: /proxy/status
→ shellRouteConfig.tsx: path: 'proxy/status' → LazyPage: L.LazyProxyStatusCompliancePage
→ lazyPages.tsx: LazyProxyStatusCompliancePage → import('../pages/proxy/ProxyStatusCompliancePage')
→ Target: src/pages/proxy/ProxyStatusCompliancePage.tsx
Actions (in order — stop at first hit):
- Route config lookup —
Grepfor the URL path segment (e.g.proxy/status) insrc/routes/shellRouteConfig.tsx. This gives you theLazyPagecomponent name. - Lazy page mapping —
Grepfor thatLazyPagename insrc/routes/lazyPages.tsx. This gives you the exact import path to the page component file. - Read the page component — follow the import path. If it's a wrapper (e.g. a tab container), read it to find the actual sub-component that renders the buggy UI.
- Stack trace shortcut — if the user provided an error stack trace with a
file:line, go directly to that file instead. Vite stack traces usesrc/paths directly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 206 lines · 44 tokens per session scan A 6db46fd67a5b
frontend-bug-trace is a skill published in the GitHub repository AlphaBitCore/nexus-gateway (25 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 44 tokens to every session and 2,124 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
defenseclaw-ops
Manage DefenseClaw enterprise security - scan components, manage tool permissions, view alerts, configure guardrails.
rust-error
Define, wrap, convert, classify, report or test Rust error types in litellm-rust with thiserror. Use when adding an error type or variant, mapping one crate's error into another, turning an error into a gateway response or Python exception, deciding retry or fault from an error, or replacing call sites that build…
rust-tracing
Add or change Rust diagnostic tracing in litellm-rust, including route spans, subscriber layers, and Python logger delivery.
lsp-guide
Recipes for the lsp tool — resolving where a symbol is defined, every place it is used, type signatures and docs, file outlines, and compiler/type errors through a real language server (Go, TypeScript/JavaScript, Python, Rust). Use when navigating or explaining code by symbol, finding callers or usages, checking what…
soc2-expert
Expert in SOC 2 compliance, trust service criteria, audit preparation, controls implementation, and security frameworks. Use when the user mentions compliance, audit, trust services, AICPA, controls, or security framework, or when the task involves Trust Service Criteria, SOC 2 Types, Security Common Criteria, or…
touch-audit
Mobile audit — app size, startup time, crash reporting, store compliance, accessibility, offline behavior. Use when asked for "mobile review", "app store readiness", "mobile performance", or "crash analysis".