Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KtKID/x-dev-pipeline --skill x-bug2raggit clone --depth 1 https://github.com/KtKID/x-dev-pipelineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-bug2rag)<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-bug2rag"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-bug2rag/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-bug2rag"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-bug2rag.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00255 | $0.03642 |
| Opus 5 | $0.00128 | $0.01821 |
| Sonnet 5 | $0.00051 | $0.00728 |
| Haiku 4.5 | $0.00026 | $0.00364 |
Grade A, and why
x-bug2rag scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 281 lines — stays where its author put it; the contents beside it link to each section on GitHub.
x-bug2rag · bug → RAG 经验沉淀
把"一次性 bug"转成"可召回的失败机制"。错题库记的不是 bug 本身，而是 bug 暴露的失败机制：触发条件 + 错误实现长什么样 + 正确实现长什么样 + 可观察差异。这种结构跨项目可复现，召回后能直接构造对/错实现的最小反例。
记什么 / 不记什么
错题库是召回素材，不是 bug tracker。一条经验值得记，当且仅当它能脱离具体项目，被未来的 spec/代码 review 召回并直接用于构造反例。
值得记（同时满足）
-
是失败机制，不是一次性事件：能说清"在什么场景下、错实现长什么样、对实现长什么样、两者可观察差异是什么"。
-
跨项目可复现：把项目名、库名、具体业务名词换掉，经验依然成立。
-
落入泛用类别之一（详见
references/triage-rules.md）：类别 典型失败机制 状态机 恢复只校验形状不校验转换、状态跳跃、非法历史态被接受 并发/时序 重试与首次并发、消息乱序、读写交错、部分失败 幂等/唯一 重试产生重复副作用、键冲突、去重漏网 边界/默认值 空集合、单元素、off-by-one、默认值被绕过 权限/越权 身份切换后权限残留、横向越权、共享状态污染 资源生命周期 超时分支漏清理、句柄泄漏、资源耗尽 持久化一致性 多阶段提交中断、索引与正文不一致、崩溃恢复窗口 数据敏感 日志/错误信息泄漏 PII、secret 进日志、错误码可枚举
抛弃信号（任一命中即弃）
- 纯领域事实：业务规则、API 限额、产品约束——这是 spec 该写的，不是经验。
- 一次性运维/环境 bug：磁盘满、机器挂了、配置手抖——不可重述，召回不到。
- 编程常识：判 null、边界检查、基本类型转换——LLM 自己会，浪费召回预算。
- 时效性强、易腐烂：某库升级后行为变了、某版本特定 bug——半年后召回到反而是误导。
- 补不齐必填字段：场景/错误实现/正确实现/可观察差异任一无法说清——召回素材不完整，等于没记。
corpus 条目格式
每条 ## AR-NNN，字段顺序固定。前三位补零，条目超过 999 后自然增长为 AR-1000。ID 由脚本自动分配，LLM 不手写。
## AR-NNN
关键词：<召回语义锚点，3-6 个，逗号分隔>
Risk：<一句具体失败机制，主语+条件+后果>
场景：<触发条件、上下文、前置状态>
错误实现：<常见错误做法长什么样>
正确实现：<对的实现长什么样>
可观察差异：<错实现 vs 对实现的可观察区分点>
分类：<上述 8 类之一>
来源：<项目/报告/issue，可选>
字段必须自包含：召回后 LLM 只读这一段就能构造反例，不需要再翻原 bug。Risk 句禁止空泛（"可能有 bug""要小心"），必须落到具体机制。
用户级默认 corpus
所有平台都通过 Python 的 Path.home() 定位用户 Home，默认 corpus 固定为：
~/.x-dev-pipeline/rag/risk-catalog.md
新用户设置分成两个独立操作。第一步只创建用户 RAG 目录：
BUG2RAG_SKILL_DIR="<当前已加载的 x-bug2rag/SKILL.md 所在目录>"
python3 "${BUG2RAG_SKILL_DIR}/scripts/home_corpus.py" init --json
第二步把插件已有 risk-catalog.md 原样复制到用户目录：
python3 "${BUG2RAG_SKILL_DIR}/scripts/home_corpus.py" \
import-existing \
--json
import-existing 默认从同一插件的
x-adversarial-risk/references/risk-catalog.md 读取。目标文件已有相同内容时返回
copied: false；目标文件已有其他内容时停止覆盖。测试新用户流程时用
--home <temporary-home> 隔离真实用户数据。
两种 corpus 存储模式
单文件模式
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 281 lines · 255 tokens per session scan A 83e367bcac93
x-bug2rag is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed today), licensed MIT. It adds 255 tokens to every session and 3,642 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-09.
Other skills, from other repositories
Cursor rules for Next
Cursor rules for Next.js development with Tailwind CSS and TypeScript integration.
potpie-cli
Use when the task is centered on running, explaining, configuring, or troubleshooting the potpie command: doctor, login, pot management, source registration, search, graph workbench reads/writes, and pot scope behavior.
browserwing-admin
Manage and operate BrowserWing — an intelligent browser automation platform. Install dependencies, configure LLM, create/manage/execute automation scripts, use AI-driven exploration to generate scripts, browse the script marketplace, and troubleshoot issues.
rag-blueprint
NVIDIA RAG Blueprint — deploy, configure, troubleshoot, and manage. Handles any RAG action: deploy, install, start, enable, disable, toggle, change, configure, troubleshoot, debug, fix, shutdown, stop, or tear down any RAG feature or service (Agentic RAG, VLM, guardrails, query rewriting, models, search, ingestion…
haystack-pipeline
Haystack NLP pipeline configuration for document processing and QA.
langchain-retriever
LangChain retriever implementation with various retrieval strategies for RAG applications.