Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andreaswasita/copilot-agents-dojo --skill autonomous-bug-fixgit clone --depth 1 https://github.com/andreaswasita/copilot-agents-dojoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andreaswasita/copilot-agents-dojo/autonomous-bug-fix)<a href="https://agentmods.dev/skills/andreaswasita/copilot-agents-dojo/autonomous-bug-fix"><img src="https://agentmods.dev/badge/skills/andreaswasita/copilot-agents-dojo/autonomous-bug-fix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/andreaswasita/copilot-agents-dojo/autonomous-bug-fix"><img src="https://agentmods.dev/badge/skills/andreaswasita/copilot-agents-dojo/autonomous-bug-fix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 14 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 56 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 111 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.01251 |
| Opus 5 | $0.00010 | $0.00626 |
| Sonnet 5 | $0.00004 | $0.00250 |
| Haiku 4.5 | $0.00002 | $0.00125 |
Grade A, and why
autonomous-bug-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Autonomous Bug Fix Skill
Walks the agent through the full reproduce → diagnose → fix → verify cycle on its own, without asking the user for navigation help, log-reading instructions, or test commands. Does NOT cover net-new feature work — for that use plan-before-code and executing-plans.
When to Use
- User reports a bug, regression, or unexpected behavior.
- CI is red on a branch you own.
- An error or warning appears in logs.
- A previously working feature stopped working.
- The user says "this is broken," "it doesn't work," or similar.
Prerequisites
- Read access to the failing component (use
glob/grepto locate it). - The
powershelltool to run tests,git, and reproduction commands. - A clean working tree on a feature branch (use
using-git-worktreesif needed). verify-before-doneskill loaded — you'll invoke it at the end.
How to Run
1. Reproduce → locate the code, run the failing path, confirm with evidence.
2. Diagnose → trace from symptom to root cause; check recent changes.
3. Fix → minimal change at the root cause + a regression test.
4. Verify → re-run reproduction + full suite via `verify-before-done`.
Quick Reference
| Phase | Action | Tool |
|---|---|---|
| Find code | Search by symbol or file pattern | grep, glob |
| Read code | Inspect the failing path | view |
| Reproduce | Run failing command/test | powershell |
| Diagnose | Recent changes / blame | powershell → git log -20 --oneline, git blame <path> |
| Edit | Minimal, root-cause fix | edit |
| Add test | Regression test | create or edit under tests/ |
| Verify | Re-run reproduction + full suite | powershell, then verify-before-done |
Procedure
Step 1: Reproduce
Find the relevant code yourself — grep for the symbol, glob for the path. Do not ask the user "which file is this in?"
Run the failing path via the powershell tool. If no failing test exists, write a minimal one that captures the bug. Confirm reproduction with concrete evidence (stack trace, exit code, log line).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 121 lines · 21 tokens per session scan A 5ae0ef35cdb8
autonomous-bug-fix is a skill published in the GitHub repository andreaswasita/copilot-agents-dojo (53 stars, last pushed 3d ago), licensed MIT. It adds 21 tokens to every session and 1,251 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
angular
Use when building, refactoring, or debugging Angular (v20/21+): standalone components, signals, zoneless change detection, @if/@for/@defer control flow, inject() DI, resource()/httpResource(), RxJS interop, NgRx SignalStore, ng CLI. NOT React (that is react), NOT Next.js (that is nextjs), NOT a TypeScript language…
cpp
Use when writing, reviewing, modernizing, building, or debugging C++ - RAII and resource lifetime, smart-pointer ownership, move semantics and the Rule of Zero/Five, target-based CMake with FetchContent, and killing undefined behavior with ASan/UBSan/TSan plus clang-tidy. NOT borrow-checker / Result-Option / cargo…
debug
Use when something is broken — a failing or flaky test, crash, wrong result or regression — and the root cause must be reproduced and proven before any fix. On-demand; callable mid-implement. NOT a feature to spec or build (that is specify/implement), NOT the lint/test gate (that is verify), NOT adversarial diff…
gamedev-physics
Use when working with a game engine's physics — rigid bodies, colliders, collision layers and masks, character controllers, joints, forces versus impulses, raycasts and shapecasts, or when a simulation is unstable (tunnelling, jitter, missed overlaps). Covers the Godot, Unity and Unreal equivalents. NOT rendering or…
observability
Use when instrumenting a service from the inside so an incident can be explained from telemetry alone — wiring OpenTelemetry logs, metrics and traces, standing up a Collector, exporting via OTLP, and defining telemetry-driven alerts. NOT outside-in uptime probes, on-call rotation, or who-gets-paged (that is…
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.