Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hex/claude-council --skill ci-fixergit clone --depth 1 https://github.com/hex/claude-councilWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hex/claude-council/ci-fixer)<a href="https://agentmods.dev/skills/hex/claude-council/ci-fixer"><img src="https://agentmods.dev/badge/skills/hex/claude-council/ci-fixer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hex/claude-council/ci-fixer"><img src="https://agentmods.dev/badge/skills/hex/claude-council/ci-fixer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.00883 |
| Opus 5.5 | $0.00012 | $0.00353 |
| Sonnet 5.5 | $0.00006 | $0.00177 |
| Haiku 4.5 | $0.00003 | $0.00088 |
Grade A, and why
ci-fixer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI Fixer
Make one failing CI job pass for the right reason. A green run earned by retrying, skipping or loosening a check is a failure of this task, not a success.
Pin the failure
- Work from the exact revision SHA, run ID and job named in the task. If the task names only a pull request or a branch, ask for them in the report rather than guessing which run is current.
- Check that the run is still relevant. A cancelled run is often superseded by a newer run on the same revision or branch. If the newest run passes, stop and report that.
- Fetch the failed job's log once and keep it. Work from that copy. Prefer the job's own status over a summary or rollup view.
- Find the first real error, not the last line. Later errors are often consequences.
Classify before changing anything
Put the failure in exactly one class and record the evidence for it:
- product: the code under test is wrong. The same failure should reproduce locally or in CI's environment.
- test harness: the test, fixture, helper or setup is wrong, flaky or order-dependent, and the product is fine.
- environment: runtime version, OS difference, missing tool, dependency resolution, disk, network, cache. The code and test are fine on another environment.
- credential: a secret, token, quota or permission is missing or expired. This is never fixable in code. Stop and report which credential and where the log shows it.
If the evidence does not settle the class, say so and report what would.
Reproduce
- Run the failing command locally with the same arguments the job used.
- If it passes locally, do not conclude the CI is wrong. Match CI's OS, runtime version, locale, timezone and environment variables, as far as you can, and try again. A local pass does not override a CI failure.
- For a suspected flake, run the single test repeatedly and record the pass and fail count. Flaky means you saw it fail and pass on the same code.
Fix
- Fix the class you identified:
- product: fix the code at the root cause, as a bug fix;
- harness: fix the test or fixture so it is deterministic, keeping what it asserts;
- environment: pin or update the version, cache key, or setup step in the repo's CI config.
- Never skip, disable, mark as expected-failure, raise a timeout without a measured reason, loosen an assertion, or add a retry loop to make the job pass.
- Keep changes to the job's failure. Record unrelated failures you notice in the report rather than fixing them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago First seen · 92 lines · 29 tokens per session scan A 732af6fe60ff
ci-fixer is a skill published in the GitHub repository hex/claude-council (880 stars, last pushed 2d ago), licensed MIT. It adds 29 tokens to every session and 883 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-26.
Other skills, from other repositories
diagnose-deployment
Surfaces PAC CLI upload errors and Dataverse async operation errors, pattern-matches against a known failure catalog, and optionally auto-fixes identified issues. Use when asked to: "diagnose deployment", "debug deployment", "deployment failed", "show deployment errors", "fix deployment issues", "show upload logs"…
meta-long-running-build-watchdog
Watches a long-running command via tmux, lets sub-agent diagnose failures and propose a fix, and records the diagnosis to memory. Designed for overnight model fine-tunes, CI image builds, or repeated regression suites that may fail intermittently.
ci-debug
Diagnose a failing CI run against an 11-pattern playbook. Classifies the failure, cites the relevant memory entry, proposes the exact fix command — but NEVER applies without explicit user approval. Use when a specific PR check or GitHub Actions run failed and you want a diagnosis instead of speculation. Don't use for…
devops-expert
Expert-level DevOps practices, culture, automation, and continuous delivery. Use when the user mentions CI/CD, automation, infrastructure, or culture, or when the task involves DevOps Culture or Culture & Process.
qa-expert
Expert-level quality assurance, testing strategies, automation, and QA processes. Use when the user mentions testing, test automation, quality assurance, or Selenium, or when the task involves Testing Types, QA Processes, Test Strategy, or Defect Management.
codeql-expert
Expert-level CodeQL for static analysis, vulnerability detection, and security code scanning. Use when the user mentions static analysis, SAST, vulnerability detection, or github security, or when the task involves writing CodeQL queries, building a CodeQL database, taint tracking, or scanning for injection and…