Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gul-labs/craftsman-marketplace --skill craft-fixgit clone --depth 1 https://github.com/gul-labs/craftsman-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gul-labs/craftsman-marketplace/craft-fix)<a href="https://agentmods.dev/skills/gul-labs/craftsman-marketplace/craft-fix"><img src="https://agentmods.dev/badge/skills/gul-labs/craftsman-marketplace/craft-fix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gul-labs/craftsman-marketplace/craft-fix"><img src="https://agentmods.dev/badge/skills/gul-labs/craftsman-marketplace/craft-fix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00182 | $0.02827 |
| Opus 5 | $0.00091 | $0.01413 |
| Sonnet 5 | $0.00036 | $0.00565 |
| Haiku 4.5 | $0.00018 | $0.00283 |
Grade A, and why
craft-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Craftsman Fix — driving fixes off an audit
craft-audit finds and ranks; this skill fixes. It reads the .craftsman/ workspace
another run already built, re-verifies the picks are still real, gets sign-off, and executes a
tightly scoped batch — then hands back to a re-run of craft-audit to confirm. It never
re-audits, never re-ranks, and never marks a finding fixed itself — only a fresh audit pass can do
that, because "not seen ≠ fixed" is the whole point of the tracker.
Handoffs (state both explicitly when this skill doesn't fire):
- No
.craftsman/at the project root → this skill does not apply. A scoped, no-audit fix request goes straight to the relevant domain craft skill. A whole-project assessment goes tocraft-audit— run that first, then come back here. .craftsman/exists but the user wants a new assessment, not a fix → that'scraft-auditre-run territory, not this skill.
The loop
Depth for every step lives in references/fix-protocol.md — this is the compact sequence.
- Precheck. Locate
.craftsman/at the project root.- Missing → stop. Tell the user to run
craft-auditfirst (give them the trigger phrase, e.g. "is my app production-ready"). - Concurrency marker (mandatory before any mutation). If
.craftsman/.run-in-progressexists, an audit is claiming the workspace (or left a stale marker). Refuse by default — do not mutatefindings.md, the master tracker, or any other.craftsman/artifact. Warn the user: either wait for the audit to finish (marker deleted on successful step 8), or treat the marker as stale only if they confirm the prior audit was abandoned. Proceed past the marker only on explicit user override after they acknowledge the race risk (fixer and auditor both writing findings/tracker). Prefer refuse; override is the exception. →craft-audit→references/workspace.md§ Concurrency marker - Present but stale → quantify it, don't eyeball it: run the same stamp comparison as
craft-audit→references/rerun.mdPart 1 (git diff --name-only <stamp>..HEADagainst the workspace's stamped commit). If the changed files intersect the scopes of the findings the user is about to pick, recommend acraft-auditre-run first. If they don't intersect, proceed — "many commits behind" alone isn't a reason to stop. The user may override and proceed anyway even when scopes intersect — record that they did. - Check for declared gated surfaces (optional, no setup required). In precedence order: (a)
.craftsman/gated-surfaces.mdif the user wrote one, (b) a statement in the project's ownCLAUDE.md/AGENTS.md/README, (c) the user saying so in chat this session. Find none of the three → nothing changes, proceed as below. →references/fix-protocol.md"Gated surfaces"
- Missing → stop. Tell the user to run
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 154 lines · 182 tokens per session scan A 7937b960af19
craft-fix is a skill published in the GitHub repository gul-labs/craftsman-marketplace (1 stars, last pushed today), licensed MIT. It adds 182 tokens to every session and 2,827 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
plumb-line-remediate
Use when applying findings from a plumb-line audit report — the builder has a report (or pasted findings) and wants the fixes made. Opt-in and separate from the audit, which is read-only and never fixes.
loud-errors
Use when you spot a swallowed, vague, or context-losing error — an empty catch, a bare except: pass, catch (e) { console.log(e) } that then continues, throw new Error("something went wrong"), an error logged then ignored, or a caught exception that drops its cause. Makes failures loud and specific: each error says…
delete-this
Use when a codebase feels heavy, when you suspect dead code, or before adding a feature to an area that's already cluttered. Finds and safely removes code that no longer earns its place — dead branches, unused exports, commented-out blocks, abandoned feature flags, speculative abstractions used once, and TODOs from a…
fix-it-now
Use the moment a real bug is found during any task — an audit, a review, a test wave, unrelated feature work — and the temptation appears to document it and move on. Defaults to fixing confirmed bugs in the current pass: a found bug is work surfaced, not work deferred. If a fix genuinely can't happen now (out of…
recipe-diagnose
Investigate problem, verify findings, and derive solutions.
audit
Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.