Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/emdash-cms/emdash/diagnosenpx skills add emdash-cms/emdash --skill diagnosegit clone --depth 1 https://github.com/emdash-cms/emdashWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.01447 |
| Opus 5 | $0.00022 | $0.00724 |
| Sonnet 5 | $0.00009 | $0.00289 |
| Haiku 4.5 | $0.00004 | $0.00145 |
Grade A, and why
diagnose scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Diagnose
Reproduce handed you a symptom -- a failing test, a screenshot, a console error, a wrong HTTP response. Find the code that produces it and explain why, in enough detail that verify can decide whether it is a bug and fix can act if it is.
You read code only. No edits, no test runs, no dev servers. The working tree is identical when you finish.
Environment
This is pure inspection, so it is entirely VFS work. Use read_file, ls, grep, and code to walk from symptom to source. Attach a container only if the diagnosis genuinely hinges on git history (git log/show run there); prefer the read-only GitHub API for commit and PR metadata.
Do not
- No edits, no
git commit, nogit push. - No GitHub writes. Read-only API GETs only.
- No network beyond the clone and the proxy-signed GitHub API.
- Touch no issue other than the one being investigated.
Procedure
- Anchor on the repro transcript. It already named a file, command, or URL -- start there. If reproduce was skipped, anchor on the file paths, error messages, or stack frames in the issue body.
- Walk from symptom to source.
- Thrown exception with a stack trace: read each frame in order from the deepest application frame (not framework internals). Confirm the call sequence matches what reproduce actually executed.
- Wrong return value: grep for the function that produced it, then trace its inputs back to where they enter the system (handler boundary, CLI entry, render call).
- Wrong HTML or DOM: identify the component or Astro page that renders it, then check what data it consumes and where that data comes from -- the bug is often in the data layer, not the render layer.
- Migration or schema bug: read the migration in question, the SchemaRegistry path that invoked it, and the surrounding migrations for ordering assumptions.
- Read the candidate code in full. Do not skim. Read the whole function, the whole handler, the whole component -- bugs hide in adjacent branches.
- Check the recurring EmDash culprits first.
- Missing
localefilter on a content-table query (a known recurring class). - SQL identifier interpolated unsafely instead of
sql.ref()/validateIdentifier(). - Off-by-one in pagination cursor encode/decode.
- Missing
awaiton a promise whose result is ignored. noUncheckedIndexedAccessundefined-handling patched with!that is now wrong.- Permission check missing or run on the wrong actor.
- Lingui
tcalled at module scope. - Physical Tailwind class (
ml-*,text-left) where a logical one belongs.
- Missing
- Pin the location. The file and the smallest line range containing the bug. One line is ideal; a function-sized range is acceptable when the bug is structural. If you cannot get below file level, you do not have a diagnosis yet -- search more.
- Rate confidence in the root cause. This axis is only how sure you are you found the responsible code -- not how easy the fix is.
- High -- traced symptom to a specific file and line range, mechanism explainable end to end; another engineer would agree.
- Medium -- right area and a strong candidate, but the mechanism is unconfirmed (reproduce was skipped/failed, or a second plausible cause you cannot rule out by reading).
- Low -- multiple indistinguishable causes, or the right area but no specific defect visible.
Rate honestly both ways. Fix does not run at
lowbut does run atmediumwhen the fix is clear -- do not reflexively rate down. A confidently located cause ishigheven when the fix involves choosing between options; that choice is the next field's job.
- Choose a fix approach (independent of confidence).
- mechanical -- one obviously-correct change: a line or tight block, no judgement (a missing
await, a wrong operator, a missinglocalefilter). - clear-best-option -- bigger than a one-liner, or several shapes exist, but one is clearly right: backwards-compatible, matches existing patterns, confirmable by the repro test. Name it and say why it beats the alternatives. Sibling code in the same file is strong evidence of intent -- if one branch already does the right thing, mirroring it is
clear-best-option, not a design decision. - needs-design-decision -- choosing correctly needs a maintainer's judgement: a new public API or option, a shared component that does not exist yet, a behavioural-contract change, or a security/performance tradeoff. Do not guess; lay out the options. Do not retreat here just because more than one fix is conceivable -- reserve it for when the right choice genuinely belongs to a maintainer.
- mechanical -- one obviously-correct change: a line or tight block, no judgement (a missing
- Write the proposed fix, always. For
mechanical/clear-best-option: the specific change -- which file, what to add/remove/change, and how the repro test proves it -- concrete enough that fix can implement it without re-deriving your reasoning. Forneeds-design-decision: the viable options, the tradeoff that separates them, and your recommendation if you have one. - Write hypothesis notes for alternative causes. What other root causes did you consider, and how did you rule them in or out? Empty only when the cause is genuinely unambiguous. This is the most valuable part of a
mediumorlowdiagnosis for the maintainer.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 65 lines · 43 tokens per session scan A 6e0d6bbbc835
diagnose is a skill published in the GitHub repository emdash-cms/emdash (12,159 stars, last pushed yesterday), licensed MIT. It adds 43 tokens to every session and 1,447 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
wordpress-plugin-to-emdash
Port a WordPress plugin to EmDash CMS. Use this skill when asked to migrate, convert, or port a WordPress plugin, theme functionality, or custom post type to EmDash. Provides concept mapping and implementation patterns.
emdash-cli
Use the EmDash CLI to manage content, schema, media, and more. Use this skill when you need to interact with a running EmDash instance from the command line — creating content, managing collections, uploading media, generating types, or scripting CMS operations.
building-emdash-site
Build and customize EmDash CMS sites on Astro. Use when creating pages, defining collections, writing seed files, querying content, rendering Portable Text, setting up menus/taxonomies/widgets, configuring deployment, or any task involving an EmDash-powered Astro site. Assumes basic Astro knowledge but provides all…
emdash-github-actions
Sets up GitHub Actions CI/CD workflows for EmDash plugins — TypeScript type-checking, ESLint linting, Vitest testing, npm publishing, and automated releases. ALWAYS use this skill when a user wants to create, add, set up, or configure GitHub Actions, CI/CD, automated checks, or deployment workflows for an EmDash…
adversarial-reviewer
Adversarial code review that assumes bugs exist and hunts for them. Use when asked to review code, find bugs, audit for correctness, stress-test a PR, or when someone says "tear this apart" or "what's wrong with this". Give no benefit of the doubt — every line is guilty until proven innocent.
agent-browser
Browser automation for testing and verification. Use when you need to interact with web UIs, verify visual changes, fill forms, or capture screenshots.