Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add joslat/maf-doctor --skill maf-issue-reportergit clone --depth 1 https://github.com/joslat/maf-doctorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joslat/maf-doctor/maf-issue-reporter)<a href="https://agentmods.dev/skills/joslat/maf-doctor/maf-issue-reporter"><img src="https://agentmods.dev/badge/skills/joslat/maf-doctor/maf-issue-reporter/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joslat/maf-doctor/maf-issue-reporter"><img src="https://agentmods.dev/badge/skills/joslat/maf-doctor/maf-issue-reporter.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.01099 |
| Opus 5 | $0.00033 | $0.00549 |
| Sonnet 5 | $0.00013 | $0.00220 |
| Haiku 4.5 | $0.00007 | $0.00110 |
Grade A, and why
maf-issue-reporter scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: maf-issue-reporter
Quick decision tree
You should file an upstream issue only when all of the following are true:
- The symptom does NOT match any entry in the obsolete-API registry (
maf://registry). IfMafDraftIssuereturns "Registry hits" — apply the deterministic fix first; don't file. - The constraint table at
maf://constraintsdoesn't already cover the pattern (e.g., session state in instance fields is a known anti-pattern, not a bug). - You can reduce the symptom to a minimal repro (15-50 lines max, no unrelated app code).
- The same symptom is not already filed at https://github.com/microsoft/agent-framework/issues.
If any of those is false → don't file. Apply the existing fix, or refine the repro.
How to file
Step 1. Run MafDraftIssue(repoPath, symptom, snippet?, expected?, actual?) to assemble the body. The tool detects:
- The tracked MAF version (from
.maf-version). - Every
Microsoft.Agents.AI*/Microsoft.Extensions.AI*<PackageReference>and its pinned version. - The .NET TFM(s) in your csproj.
- Any registry entries that approximately match your symptom.
It outputs a markdown body ready to paste.
Step 2. Review the body. Strip:
- Internal file paths (e.g.
C:\Users\you\company-secret\…). - Internal identifiers (employee IDs, customer account numbers, internal team names).
- Any secrets that leaked into the stack trace.
Step 3. Post. Two routes:
- Manual: copy the body, navigate to https://github.com/microsoft/agent-framework/issues/new, paste, submit.
- Via the GitHub MCP server: if you have the official github-mcp-server installed, ask Copilot Chat to "create an issue in
microsoft/agent-frameworktitled<title>with this body." The GitHub MCP server'screate_issuetool handles the API call. Never use a personal access token from insidemaf-autopilotdirectly — that's why we don't post; the github-mcp-server (or a manual paste) keeps the trust boundary right.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 65 lines · 66 tokens per session scan A 0d4e997d87e1
maf-issue-reporter is a skill published in the GitHub repository joslat/maf-doctor (14 stars, last pushed 25d ago), licensed MIT. It adds 66 tokens to every session and 1,099 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
winui-session-report
Analyze the current or a recent agent session (GitHub Copilot CLI or Claude Code) and generate a diagnostic report. Use only when the user explicitly asks for session feedback, agent debugging, or a review of what happened during a build session. Do not inspect session data automatically.
chrome-devtools-mcp
Use Chrome DevTools MCP from .NET agents and .NET-focused repos to inspect, debug, and automate Chrome through an MCP client. USE FOR: the repo needs browser-level debugging for ASP.NET Core, Blazor, WebAssembly, or any .NET app with a web UI; the user wants an MCP server that can inspect console. DO NOT USE FOR: pure…
managedcode-orleans-graph
Integrate ManagedCode.Orleans.Graph into an Orleans-based .NET application for grain-call policy enforcement, deadlock detection, live-call telemetry, and Mermaid graph diagnostics. USE FOR: ManagedCode.Orleans.Graph integration; allowed grain transitions; Orleans call filters; live policy graphs; reviewing Orleans…
asynkron-profiler
Use the open-source free Asynkron.Profiler dotnet tool for CLI-first CPU, allocation, exception, contention, and heap profiling of .NET commands or existing trace artifacts. USE FOR: Asynkron.Profiler setup; automation-friendly profiling output; CPU, allocation, exception, contention, and heap investigation. DO NOT…
profiling
Use the free official .NET diagnostics CLI tools for profiling and runtime investigation in .NET repositories. USE FOR: the repo needs performance or runtime profiling for a .NET application; the user asks about slow code, high CPU, GC pressure, allocation growth, exception storms, lock. DO NOT USE FOR: replacing…
component-flattening-analysis
Detects misplaced classes and fixes component hierarchy problems — finds code that should belong inside a component but sits at the root level. Use when asking "clean up component structure", "find orphaned classes", "fix module hierarchy", "flatten nested components", or analyzing why namespaces have misplaced code.…