Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Firstp1ck/pi-coding-agent-forge --skill bounded-code-repairgit clone --depth 1 https://github.com/Firstp1ck/pi-coding-agent-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/firstp1ck/pi-coding-agent-forge/bounded-code-repair)<a href="https://agentmods.dev/skills/firstp1ck/pi-coding-agent-forge/bounded-code-repair"><img src="https://agentmods.dev/badge/skills/firstp1ck/pi-coding-agent-forge/bounded-code-repair/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/firstp1ck/pi-coding-agent-forge/bounded-code-repair"><img src="https://agentmods.dev/badge/skills/firstp1ck/pi-coding-agent-forge/bounded-code-repair.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.01195 |
| Opus 5.5 | $0.00019 | $0.00478 |
| Sonnet 5.5 | $0.00009 | $0.00239 |
| Haiku 4.5 | $0.00005 | $0.00120 |
Grade A, and why
bounded-code-repair scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bounded code repair
Make the smallest patch that resolves one defined behavior, then prove the affected behavior with observed checks. A green command, a diff marker, or a model statement alone is not completion evidence.
When to Use
Should trigger
- “Fix the focused failing test in this named module and add a regression test.”
- “Make this small behavior-preserving refactor without changing the public API.”
- “Repair this parser result in the two named files, then run its targeted checks.”
Should not trigger
- “Design and deliver a new multi-area feature.”
- “Audit the repository for security issues.”
- “Update prose only, with no code behavior change.”
- “Explain an unfamiliar repository without requesting a modification.”
Invocation Design
- Invocation mode: model-invoked for a focused code patch with an inspectable target.
- Leading concept: one behavioral objective inside one explicit write boundary.
- Default scope: at most three files and one behavior; a user or governing workflow must explicitly widen it.
- Completion criterion: a minimal in-scope diff and fresh, relevant observed validation both support the stated acceptance criteria.
Inputs and Assumptions
Establish the failing or desired behavior, acceptance criteria, allowed write paths, forbidden/shared paths, relevant symbols and callers, existing tests, exact validation commands, and any version-sensitive dependency surface. Repository instructions, user requirements, observed tool results, and model hypotheses remain separate trust sources.
Portable Workflow
- State one bug or bounded behavior and its acceptance criteria.
- Completion criterion: the desired outcome is observable, not merely “improve” or “clean up.”
- Inspect the target, callers, tests, and relevant configuration before mutation.
- Completion criterion: the patch target and its expected effect are evidence-backed.
- Declare the write boundary and forbidden/shared paths.
- Completion criterion: a path outside the boundary has an escalation path rather than an implicit exception.
- Check version-sensitive dependencies when the patch relies on a framework, library, runtime, CLI, API, or schema.
- Completion criterion: advice is tied to the exact installed version and source, or the work stops as unknown.
- Implement the smallest patch that satisfies the objective.
- Completion criterion: the final diff has no unrelated cleanup, weakened tests, or broadened behavior without authorization.
- Run targeted checks, then affected broader checks when warranted.
- Completion criterion: a host-observed result supports each material criterion; unavailable checks remain unknown.
- Inspect the final diff and retry at most twice after validation failure.
- Completion criterion: each retry follows an observed failure; architecture, security, migration, dependency, or multi-subsystem decisions escalate.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 78 lines · 47 tokens per session scan A d7ba974838aa
bounded-code-repair is a skill published in the GitHub repository Firstp1ck/pi-coding-agent-forge (90 stars, last pushed today), licensed MIT. It adds 47 tokens to every session and 1,195 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-14.
Other skills, from other repositories
investigate
A structured root-cause investigation method for software bugs. It moves from history and reproduction through tested hypotheses, a focused fix, verification, and a report.
testing
Skill validation framework PLUS daily test-suite health and regression intelligence. Validates skill conformance (frontmatter, manifest coverage, resolver coverage). Runs the project test suite in tiered phases (unit / evals / integration / system health), classifies failures, and produces a regression-aware report.
confirm-failures-are-causally-linked-to-the-task-before-reportin
When delegating a task affected by this skill, include.
restore-internals-seams-in-finally-blocks-after-each-test
When delegating a task affected by this skill, include.
run-affected-test-file-in-isolation-and-in-co-run-with-its-test-
When delegating a task affected by this skill, include.
use-internals-di-seam-pattern-for-test-injectable-functions
When delegating a task affected by this skill, include.