Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dohooo/helmor/helmor-debug-loopnpx skills add dohooo/helmor --skill helmor-debug-loopgit clone --depth 1 https://github.com/dohooo/helmorWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00100 | $0.00751 |
| Opus 5 | $0.00050 | $0.00376 |
| Sonnet 5 | $0.00020 | $0.00150 |
| Haiku 4.5 | $0.00010 | $0.00075 |
Grade A, and why
helmor-debug-loop scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Helmor Debug Loop
Use this skill to drive a bounded reproduce -> instrument -> inspect -> fix -> verify loop for Helmor local-dev bugs. Always use $helmor-debug-operate for actual local app control through Tauri MCP; this skill owns the debugging strategy and evidence discipline.
Core Loop
- Define the suspected behavior, expected behavior, and success signal in one or two sentences.
- Reproduce through
$helmor-debug-operatewith real UI actions when possible. Start with screenshots, DOM/accessibility snapshots, IPC monitor, console/system logs, and terminal buffers. - If evidence is insufficient, add the smallest temporary log or probe with a unique prefix such as
[debug-loop:<slug>], rerun the flow, then remove or justify the probe before finalizing. - Analyze the evidence before editing product code. Prefer a narrow fix that explains the observed signal.
- Verify the fix with the same user path. For user-visible flows, require three consecutive successful runs unless the user explicitly lowers the bar.
- Produce an evidence pack under
.agent-contexts/<task-slug>/with repro attempts, logs, screenshots, IPC, fix summary, and remaining uncertainty.
Fault Tolerance
- If you cannot reproduce after three distinct attempts, do not invent a failure. Mark the state as
not reproduced, preserve evidence, inspect code paths that should have fired, and report the most likely missing precondition. - If the bug is flaky, run at least three attempts and compare evidence. Treat intermittent pass/fail as a valid finding, not a failure of the loop.
- If Tauri MCP cannot connect, use
$helmor-debug-operaterecovery steps. If the bridge remains unavailable, fall back to static code analysis and terminal tests, and label UI verification as blocked. - If a skill recipe fails three times, follow
$helmor-debug-operatestale-skill rules: reason from fresh screenshots/DOM/code, record a candidate skill update, and ask before editing that skill unless the user explicitly requested it. - If adding logs risks exposing secrets, log shape/count/state only. Never print access tokens, credentials, API keys, cookies, or private account details.
- If verification cannot be run safely because it would mutate durable user data, switch to a disposable workspace/session or stop and state the risk.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 39 lines · 100 tokens per session scan A 4ce3dd038c93
helmor-debug-loop is a skill published in the GitHub repository dohooo/helmor (1,296 stars, last pushed 10d ago), licensed Apache-2.0. It adds 100 tokens to every session and 751 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
execution
M-1.4 execution skill — 跑 single task 产 patch + 提交 envelope。.
fix-self-check
M-1.6 envelope self-check——独立性保证不自欺欺人 (5 blockingcheck)。由 CLI ./tw fix complete --self-check-mode fork(默认即 fork)自动派起,不经 Skill 工具调用;fix 主会话产 FixCompleted 前直读本文,是为理解双层验证关系。.
review
M-1.5 review skill — 在 patch 跟 contract 之间找 finding，produce Finding 一等对象。.
dependency-analyze
从 task 的 read/write set + concept statemachine 推导 6 种依赖类型的提案。主 planner 决定边的真实性。派它时只给 read/write set 与疑点、不给预期边集；已有预判逐条标「待复核」交它取证。.
execution-self-check
Pre-submit 自检——envelope 提交 commit gate 前必跑。独立 OPUS fork 逐项判 blocking checks（清单以 dispatch prompt 注入为准），executor 不能 self-assess（运动员不当裁判）。.
fix
修复者 — 把一条被发现的问题（finding）按它的闭合合约修干净，修一个不制造下一个。产 FixProposed + 临时的 FixCompleted，不自判问题关闭（那是复查的权）。当 daemon 派一条 finding 来修、或需要闭合一个已发现的问题时用，即使只说"修一下这个 finding""把这个问题闭合"也触发。调用名就是 fix（Skill 工具）或 /fix（命令），没有 harness: 之类的前缀。.