Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add iampantherr/SecureContext --skill developer-debugging-methodologygit clone --depth 1 https://github.com/iampantherr/SecureContextWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iampantherr/securecontext/developer-debugging-methodology)<a href="https://agentmods.dev/skills/iampantherr/securecontext/developer-debugging-methodology"><img src="https://agentmods.dev/badge/skills/iampantherr/securecontext/developer-debugging-methodology/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/iampantherr/securecontext/developer-debugging-methodology"><img src="https://agentmods.dev/badge/skills/iampantherr/securecontext/developer-debugging-methodology.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.00508 |
| Opus 5 | $0.00010 | $0.00254 |
| Sonnet 5 | $0.00004 | $0.00102 |
| Haiku 4.5 | $0.00002 | $0.00051 |
Grade A, and why
developer-debugging-methodology scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
DEBUGGING METHODOLOGY
(Extracted from roles.json deepPrompt for the developer role during the v0.19.0 role/skill split. Original content preserved verbatim. Edit freely; the mutator will propose improvements based on skill_runs telemetry once this skill is invoked by an agent.)
Binary Search Bisection: When you don't know where a bug lives, bisect the problem space. Comment out half the code path. If the bug disappears, it's in the removed half. If it persists, it's in the remaining half. Repeat. This works on git commits (git bisect), on SQL queries, on HTTP middleware chains, on configuration.
Hypothesis-Driven Debugging: State your hypothesis explicitly before running any experiment. "I think the bug is in the auth middleware because the request reaches the controller but the user context is empty." Run the minimum experiment to confirm or deny. If it denies, update the hypothesis. Never run experiments randomly — that's superstition, not debugging.
Symptoms vs Root Causes: A 500 error is a symptom. A null pointer dereference is a cause. A missing foreign key constraint is a root cause. Keep asking "why" until you reach a decision, not a circumstance. The fix lives at the root cause, not the symptom. Fixing symptoms leads to whack-a-mole.
Reproduce Before Fix: The bug must be reproducible in a controlled environment before any code changes. Ideal: a failing automated test. Minimum: a reliable manual repro with exact steps. A fix deployed without a reproduction is a change, not a fix.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 34 lines · 21 tokens per session scan A e6bc44ccc417
developer-debugging-methodology is a skill published in the GitHub repository iampantherr/SecureContext (8 stars, last pushed 2d ago), licensed MIT. It adds 21 tokens to every session and 508 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other skills, from other repositories
git-investigate
Git history investigation. Use when: tracking code changes, finding where bugs were introduced, root cause analysis. Not for: code exploration (use code-explore), issue analysis (use issue-analyze). Output: history trace + root cause report.
resolving-merge-conflicts
Use when a git merge or rebase reports conflicts and the operation is in progress.
morning
Use when the user says "/nightshift:morning", "what happened overnight", "how did the night go", "why did the loop stop", or opens a session in a repo with a loop/ directory after a scheduled run. Reads the journal since the last start line and every open land / land:blocked pull request, says per stop what happened…
doctor
A diagnostic command for codex-compressor, a tool that manages Codex settings and hooks. It checks Python, platform support, permissions, hook support, and buffer settings.
gh-pr-merge-worktree-checkout-trap
Diagnose and bypass gh pr merge --squash --delete-branch failing with "failed to run git: fatal: 'main' is already used by worktree at ..." when another git worktree has main checked out. Use when: (1) you run gh pr merge and see this exact error, (2) you have multiple worktrees in the repo (e.g. .claude/worktrees/)…
pr-conflict-from-mid-flight-merges
A pull request that was clean when you opened it now says on GitHub "This branch has conflicts that must be resolved", because others landed on main over the days it sat open. Use when gh pr view N --json mergeable,mergeStateStatus returns CONFLICTING and DIRTY, when your branch carries commits you do not recognise…