Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ccevans/bobbycode --skill bobby-debuggit clone --depth 1 https://github.com/ccevans/bobbycodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccevans/bobbycode/bobby-debug)<a href="https://agentmods.dev/skills/ccevans/bobbycode/bobby-debug"><img src="https://agentmods.dev/badge/skills/ccevans/bobbycode/bobby-debug/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccevans/bobbycode/bobby-debug"><img src="https://agentmods.dev/badge/skills/ccevans/bobbycode/bobby-debug.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.01257 |
| Opus 5.5 | $0.00019 | $0.00503 |
| Sonnet 5.5 | $0.00010 | $0.00251 |
| Haiku 4.5 | $0.00005 | $0.00126 |
Grade A, and why
debug-investigate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bobby Debug Skill
Systematic root-cause debugging. Reproduce → Hypothesize → Trace → Verify → Fix. Never guess — follow the evidence.
Before Starting
- Check learnings — Read
.claude/skills/bobby-debug/learnings.md+.claude/skills/bobby-debug/learnings.local.md - Read the ticket's
ticket.md— understand the expected vs actual behavior - Read rejection comments — understand what was tried and what failed
- Run
git log --oneline -10to see recent changes
Investigation Methodology
<investigation_rules> Follow this process strictly. Do not skip steps or jump to fixes.
Step 1: Reproduce
- Reproduce the failure with the exact steps from the rejection comment or bug report
- If it's a test failure: run the specific test and capture the full output
- If it's a runtime failure: trigger the exact flow and capture error output
- If you cannot reproduce the bug, STOP. Report that the bug is not reproducible with the given steps.
Step 2: Hypothesize
- Based on the error output and code path, form 1-3 hypotheses about the root cause
- Write them down explicitly before investigating:
- H1: "{description of what might be wrong}"
- H2: "{alternative explanation}"
- H3: "{less likely but possible cause}"
Step 3: Trace
- For each hypothesis, trace the data flow through the code:
- Read the entry point (API route, event handler, test setup)
- Follow the call chain to where the error occurs
- Check variable values, types, and state at each step
- Use targeted
console.log/print/ debugger statements if needed (remove before committing)
- Read files in parallel when tracing multiple hypotheses
Step 4: Verify
- Identify which hypothesis is correct based on tracing evidence
- Confirm by finding the exact line(s) where the bug manifests
- Document: "Root cause: {specific explanation with file:line references}"
Step 5: Fix
- Write the minimal fix that addresses the root cause
- Write or update a test that would catch this regression
- Run the full test suite:
npm test - Run lint:
npm run lint</investigation_rules>
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 128 lines · 48 tokens per session scan A 89a36cb3961f
debug-investigate is a skill published in the GitHub repository ccevans/bobbycode (6 stars, last pushed 2d ago), licensed MIT. It adds 48 tokens to every session and 1,257 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
amq-cli
Coordinate coding agents through AMQ. Use for agent messages, inboxes, receipts, sessions, wake delivery, cross-project routing, managed launches, or AMQ diagnostics. Use amq-spec for collaborative design; do not use this for general message queues or single-agent work.
shadow-verify
Dispatch a parallel adversarial verifier wave after any high-stakes sub-agent investigation (code reviews, audits, findings reports, large refactors, gap analyses) — or whenever a sub-agent asserts a claim with high-confidence language, since confidence is a trigger, not a verdict. Use when sub-agent output will drive…
systematic-debugging
Root-causing defects instead of guessing: reproduce, isolate, instrument component boundaries, kill hypotheses, and recognise when to question the design. Use on any bug, flaky test, or unexplained behaviour.
diagnose
Parallel root-cause analysis for bugs and failing tests. Use when a test fails, a bug is reported, or behavior is unexplained — dispatches sub-agents to form and validate hypotheses in isolated worktrees.
aiox-dev
Full Stack Developer (Dex). Use for code implementation, debugging, refactoring, and development best practices.
hatch3r-incident-response
Handles production incidents with structured triage, mitigation, and post-mortem. Use when responding to production issues, outages, or security incidents.