A structured process for testing a software project such as a command-line tool, API, backend, or library. It explores the available interface, tries normal and edge-case inputs, and records reproducible evidence for each problem.

Set up a target, inspect its commands or API, test features and edge cases, collect logs, and produce a report of confirmed bugs and usability issues.

Ad-hoc testing can miss usability issues and unusual failures. This process makes findings easier to reproduce and gives developers concrete logs and inputs to investigate.

How av/harbor configures Claude Code and Codex

About the project

av/harbor is a command-line tool and companion app that uses Docker Compose to start a connected local stack of language-model backends, user interfaces, and supporting AI services. People use it to run services such as Ollama, llama.cpp, vLLM, Open WebUI, search, voice, and image-generation tools without configuring their connections manually, while the catalogue provides agent workflows for operating Harbor.

av/harbor · 3,263 stars · on GitHub · discord.gg

Reuse

Borrowing it

Nothing to install: this file belongs to av/harbor. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/av/harbor/main/.agents/skills/bugbash/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/av/harbor

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/av/harbor/bugbash/github.svg)](https://agentmods.dev/skills/av/harbor/bugbash)

Your own site

<a href="https://agentmods.dev/skills/av/harbor/bugbash"><img src="https://agentmods.dev/badge/skills/av/harbor/bugbash/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/av/harbor/bugbash"><img src="https://agentmods.dev/badge/skills/av/harbor/bugbash.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 58 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,276 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00058	$0.01276
Opus 5.5	$0.00023	$0.00510
Sonnet 5.5	$0.00012	$0.00255
Haiku 4.5	$0.00006	$0.00128

Measured 2mo ago against content hash a587c2fa6c2c, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

bugbash scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

3. **Repro Steps:** Exact commands run, API requests made (e.g., `curl` commands), or code executed.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

bugbash — 100% identical, 0 lines differ

.agents/skills/bugbash/SKILL.md · 101 lines

How it starts

The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Bugbash (General Software)

Systematically explore a software project, find issues, and produce a report with full reproduction evidence for every finding. This skill applies to CLIs, APIs, Backends, Libraries, and other non-web interfaces.

Setup

Identify the Target (e.g., a CLI binary, an API base URL, a Python package).

Parameter	Default	Example override
Target	(required)	`./my-cli`, `http://localhost:8080`, `import mylib`
Output directory	`/tmp/dogfood-output/`	`Output directory: ./qa-reports`
Scope	Full project	`Focus on the auth middleware`

Workflow

1. Initialize    Set up output dirs, report file, build/start the software
2. Orient        Discover surface area (help menus, API schemas, exported functions)
3. Explore       Systematically test features, inputs, and edge cases
4. Document      Record exact inputs, outputs, and logs for each issue
5. Wrap up       Update summary counts, finalize report

1. Initialize

mkdir -p {OUTPUT_DIR}/logs {OUTPUT_DIR}/evidence

Create a report.md in the output directory and fill in the header fields. Include:

Target
Date
Environment Details (OS, language version)
Summary Counts (Critical, High, Medium, Low)

If the software needs to be built or started (e.g., npm run build, docker-compose up, cargo build), do that now. Keep track of the startup logs and run servers in the background if necessary (e.g., using & and redirecting output).

2. Orient

Map out the surface area of the software before testing.

For CLIs: Run {TARGET} --help, list subcommands, check environment variable configurations.
For APIs: Fetch OpenAPI/Swagger specs, list route definitions in code, or run a schema discovery tool.
For Libraries: Inspect exported modules, classes, and public methods.

Save this initial mapping to {OUTPUT_DIR}/surface-area.txt.

3. Explore

Work through the surface area systematically.

Read the full file on GitHub · 101 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

README.md 326 B

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 101 lines · 58 tokens per session scan A a587c2fa6c2c

Subscribe to this mod's changes

bugbash is a skill published in the GitHub repository av/harbor (3,263 stars, last pushed 6d ago), licensed Apache-2.0. It adds 58 tokens to every session and 1,276 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Debugging LLM Testing ai cli docker docker-compose tools

bugbash next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
bugbashav/harbor	Skill	3.3k	6d ago	Apache-2.0	A	58	Claude Code, Codex
docker-managementfurkangonel/cowrangler	Skill	1	1mo ago	MIT	C	16	Claude Code, Codex
optimization1jehuang/jcode	Skill	22k	yesterday	MIT	A	52	Claude Code
smiles-validationsynthetic-sciences/openscience	Skill	4.3k	2d ago	Apache-2.0	A	24	Claude Code, Codex
ixix-infrastructure/Ix	Skill	1.1k	today	Apache-2.0	A	44	Claude Code, Codex
files-inspectkurtosis-tech/kurtosis	Skill	558	4d ago	Apache-2.0	A	51	Claude Code, Codex
starlark-devkurtosis-tech/kurtosis	Skill	558	4d ago	Apache-2.0	A	50	Claude Code, Codex

harbor: Skill for Claude Code