Borrowing it
Nothing to install: this file belongs to arcasilesgroup/ai-engineering. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/arcasilesgroup/ai-engineering/main/.agents/skills/ai-report/SKILL.mdgit clone --depth 1 https://github.com/arcasilesgroup/ai-engineeringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arcasilesgroup/ai-engineering/ai-report)<a href="https://agentmods.dev/skills/arcasilesgroup/ai-engineering/ai-report"><img src="https://agentmods.dev/badge/skills/arcasilesgroup/ai-engineering/ai-report.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00132 | $0.00688 |
| Opus 5 | $0.00066 | $0.00344 |
| Sonnet 5 | $0.00026 | $0.00138 |
| Haiku 4.5 | $0.00013 | $0.00069 |
Grade A, and why
ai-report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Report the framework's own fault, and collect nothing on the way
What it produces
.ai/issue/draft.json — local, gitignored, previewed byte for byte, and sent by nobody
but you.
Steps
-
Reproduce it first. A report of something that happened once is a report the person reading it cannot act on, and the steps field is what makes the difference.
-
Decide the kind before you write.
--kind securitynever becomes a public issue: the command refuses that route before it asks you anything, and prints the private one. -
Write the four fields in your own words: the title, what happened, what you expected, and one
--stepper step. Never paste a log, a diff, a traceback or a command line — there is no field for any of them, and a pasted command carries the path it ran from. -
Run it:
ai-eng report issue --kind bug --title "…" --what-happened "…" \ --expected "…" --step "…" --step "…" -
Read the refusal if you get one.
ACCEPTANCE_MACHINE_PATH_*,ACCEPTANCE_PII_*andACCEPTANCE_GITLEAKS_SECRETeach name what was found, no draft is written, and the fix is to say the same thing without the value it carried. -
Read the bytes it prints. They are exactly what would leave, and the SHA-256 beside them is of those bytes. If anything in there is not yours to publish, stop.
-
Sending is separate and manual.
--submitasks for a phrase carrying that digest at your keyboard, and then says there is nowhere to send: no destination is configured and this package has no transport. Take the previewed bytes to the route your organisation uses.
What this is not
- "The fault is obvious, so the report needs no reproduction steps" — a report of something that happened once is a report the person reading it cannot act on, and the steps field is what makes the difference.
Done when
- Every field is a sentence you wrote, and nothing in the payload was collected.
- The scan came back clean, or you rewrote the field it named rather than working around it.
- A vulnerability went to private disclosure and no public issue exists for it.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 56 lines · 132 tokens per session scan A 5d887593ad43
ai-report is a skill published in the GitHub repository arcasilesgroup/ai-engineering (54 stars, last pushed 5d ago), licensed Apache-2.0. It adds 132 tokens to every session and 688 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hotfix
Fixes an observed defect with reproducible evidence in one call: writes a short trace doc before touching code, implements the fix, and backs it with a regression test written before the fix. Production incidents are the motivating case, not a gate. When blocked, it halts by name and saves the doc for a later call to…
okteto-debugging
Use when the user describes a broken or unhealthy Okteto environment. Triggers on phrases like: "service is crashing", "service keeps restarting", "service won't start", "environment is broken", "deployment is failing", "pods are stuck", "pods are not ready", "pods are pending", "CrashLoopBackOff", "OOMKilled"…
phoenix-doctor
Diagnose and repair a Phoenix install with the same objective discipline Phoenix gives the agent — check whether the installed agent, skills, and MCP registration match what this build ships, and re-sync any drift with a snapshot-backed fix that is re-verified red→green. Use when Copilot says "No such agent: phoenix"…
phoenix-build
Implement one planned step at a time under the verify-heal loop — snapshot before risky edits, make the smallest change, sense the objective check, and heal (rollback or retry) if it goes red. Never advance to the next step on a red check, never claim a step done without a green sense. Use during implementation, or…
phoenix-debug
Systematic triage and self-healing when something breaks — reproduce with an objective check first, isolate the cause with the code graph, fix the root not the symptom, and confirm with phoenixsense before claiming it resolved. Use when a test/build is red, a regression appears, or the user says /phoenix-debug, "it…
phoenix-self-heal
The core verify-then-heal loop usable on its own for any change with a checkable outcome — sense success objectively, snapshot known-good state, and recover (bounded rollback or retry) when a check goes red, confirmed by an external recheck. Use whenever you make a change that has a runnable test/build/lint, or when…