Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/crumbtraildev/crumbtrail-cli/missing-key-detonationnpx skills add CrumbtrailDev/crumbtrail-cli --skill missing-key-detonationgit clone --depth 1 https://github.com/CrumbtrailDev/crumbtrail-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/crumbtraildev/crumbtrail-cli/missing-key-detonation)<a href="https://agentmods.dev/skills/crumbtraildev/crumbtrail-cli/missing-key-detonation"><img src="https://agentmods.dev/badge/skills/crumbtraildev/crumbtrail-cli/missing-key-detonation.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.01790 |
| Opus 5 | $0.00042 | $0.00895 |
| Sonnet 5 | $0.00017 | $0.00358 |
| Haiku 4.5 | $0.00008 | $0.00179 |
Grade A, and why
missing-key-detonation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.
The missing key detonation, where the payload is not the model
Code is written against the model in someone's head. The payload is produced by a different system, for a different reason, and for one row, one account, one provider or one mode the field the code treats as always present is simply not there. Direct access explodes.
The same family covers the softer version: the field is present but legitimately null, or an empty array, or a string where a number was expected, and the code that receives it assumed otherwise.
The failed obvious fix for this family is the per symptom guard. Adding an optional access at the crash site stops that crash and leaves every sibling site intact, so the class recurs indefinitely. When you write the diagnosis, name where the contract should be checked, not only where it blew up.
Symptom
A property read on undefined or null, usually as a type error naming the property. The stack points at rendering or mapping code. Most data works; one item, one account or one mode does not. A list renders down to a particular row and stops.
Frequently the reporter describes it as affecting only them, or only one record, which is exactly right and is the most useful thing they said.
What Crumbtrail can see
This archetype is well served, because the payload that caused it crossed a boundary the recorder watches.
- Uncaught errors with the message, the file, the line, the column and the full stack, and unhandled rejections with the message and stack. The property name is normally in the message.
- The response that carried the payload, including its body. Large bodies are summarized and a summary records the original length and why it was reduced. This is the point of the whole sequence: you can read the object the code choked on rather than guess at it.
- Backend response bodies where the backend SDK is installed, so you can see whether the field was already missing when the server produced it.
- Row reads and row changes where the database adapter is installed, which is how you tell a genuinely null column from a field dropped in serialization.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 165 lines · 84 tokens per session scan A cf2af8860165
missing-key-detonation is a skill published in the GitHub repository CrumbtrailDev/crumbtrail-cli (0 stars, last pushed yesterday), licensed MIT. It adds 84 tokens to every session and 1,790 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
codegraph
Analyze indexed codebases via graph database (neug) and vector index (zvec). Covers call graphs, dependencies, dead code, hotspots, module coupling, architecture reports, semantic search, impact analysis, bug root cause from GitHub issues, class diagrams (UML), and PR review (risk scoring, conflict detection…
stuck
Diagnose frozen, stuck, or slow Qwen Code sessions on this machine. Scans for problematic processes, high CPU/memory usage, hung subprocesses, and debug logs. Use /stuck or /stuck to focus on a specific process.
structured-debugging
Hypothesis-driven debugging methodology for hard bugs. Use this skill whenever you're investigating non-trivial bugs, unexpected behavior, flaky tests, or tracing issues through complex systems. Activate proactively when debugging requires more than a quick glance — especially when the first attempt at a fix didn't…
memory-leak-debug
Diagnose memory leaks in the Qwen Code CLI using heap snapshots and the chrome-devtools CLI. Use when investigating high memory usage, unbounded growth, or suspected object retention issues.
bugfix
Fix a bug from a GitHub issue, following the reproduce-first workflow. Use when the user asks to fix a bug, investigate a GitHub issue, or debug a user-reported problem. Takes a GitHub issue URL or number as input.
rust-check
Run cargo check on the current Rust project to find compile errors.