Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KtKID/x-dev-pipeline --skill x-bug2raggit clone --depth 1 https://github.com/KtKID/x-dev-pipelineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-bug2rag)<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-bug2rag"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-bug2rag/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-bug2rag"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-bug2rag.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00255 | $0.03642 |
| Opus 5.5 | $0.00102 | $0.01457 |
| Sonnet 5.5 | $0.00051 | $0.00728 |
| Haiku 4.5 | $0.00026 | $0.00364 |
Grade A, and why
x-bug2rag scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 281 lines — stays where its author put it; the contents beside it link to each section on GitHub.
x-bug2rag · bug → RAG 经验沉淀
把"一次性 bug"转成"可召回的失败机制"。错题库记的不是 bug 本身，而是 bug 暴露的失败机制：触发条件 + 错误实现长什么样 + 正确实现长什么样 + 可观察差异。这种结构跨项目可复现，召回后能直接构造对/错实现的最小反例。
记什么 / 不记什么
错题库是召回素材，不是 bug tracker。一条经验值得记，当且仅当它能脱离具体项目，被未来的 spec/代码 review 召回并直接用于构造反例。
值得记（同时满足）
-
是失败机制，不是一次性事件：能说清"在什么场景下、错实现长什么样、对实现长什么样、两者可观察差异是什么"。
-
跨项目可复现：把项目名、库名、具体业务名词换掉，经验依然成立。
-
落入泛用类别之一（详见
references/triage-rules.md）：类别 典型失败机制 状态机 恢复只校验形状不校验转换、状态跳跃、非法历史态被接受 并发/时序 重试与首次并发、消息乱序、读写交错、部分失败 幂等/唯一 重试产生重复副作用、键冲突、去重漏网 边界/默认值 空集合、单元素、off-by-one、默认值被绕过 权限/越权 身份切换后权限残留、横向越权、共享状态污染 资源生命周期 超时分支漏清理、句柄泄漏、资源耗尽 持久化一致性 多阶段提交中断、索引与正文不一致、崩溃恢复窗口 数据敏感 日志/错误信息泄漏 PII、secret 进日志、错误码可枚举
抛弃信号（任一命中即弃）
- 纯领域事实：业务规则、API 限额、产品约束——这是 spec 该写的，不是经验。
- 一次性运维/环境 bug：磁盘满、机器挂了、配置手抖——不可重述，召回不到。
- 编程常识：判 null、边界检查、基本类型转换——LLM 自己会，浪费召回预算。
- 时效性强、易腐烂：某库升级后行为变了、某版本特定 bug——半年后召回到反而是误导。
- 补不齐必填字段：场景/错误实现/正确实现/可观察差异任一无法说清——召回素材不完整，等于没记。
corpus 条目格式
每条 ## AR-NNN，字段顺序固定。前三位补零，条目超过 999 后自然增长为 AR-1000。ID 由脚本自动分配，LLM 不手写。
## AR-NNN
关键词：<召回语义锚点，3-6 个，逗号分隔>
Risk：<一句具体失败机制，主语+条件+后果>
场景：<触发条件、上下文、前置状态>
错误实现：<常见错误做法长什么样>
正确实现：<对的实现长什么样>
可观察差异：<错实现 vs 对实现的可观察区分点>
分类：<上述 8 类之一>
来源：<项目/报告/issue，可选>
字段必须自包含：召回后 LLM 只读这一段就能构造反例，不需要再翻原 bug。Risk 句禁止空泛（"可能有 bug""要小心"），必须落到具体机制。
用户级默认 corpus
所有平台都通过 Python 的 Path.home() 定位用户 Home，默认 corpus 固定为：
~/.x-dev-pipeline/rag/risk-catalog.md
新用户设置分成两个独立操作。第一步只创建用户 RAG 目录：
BUG2RAG_SKILL_DIR="<当前已加载的 x-bug2rag/SKILL.md 所在目录>"
python3 "${BUG2RAG_SKILL_DIR}/scripts/home_corpus.py" init --json
第二步把插件已有 risk-catalog.md 原样复制到用户目录：
python3 "${BUG2RAG_SKILL_DIR}/scripts/home_corpus.py" \
import-existing \
--json
import-existing 默认从同一插件的
x-adversarial-risk/references/risk-catalog.md 读取。目标文件已有相同内容时返回
copied: false；目标文件已有其他内容时停止覆盖。测试新用户流程时用
--home <temporary-home> 隔离真实用户数据。
两种 corpus 存储模式
单文件模式
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 281 lines · 255 tokens per session scan A 83e367bcac93
x-bug2rag is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed 11d ago), licensed MIT. It adds 255 tokens to every session and 3,642 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-09.
Other skills, from other repositories
answer-audit
Adversarially audit a RAG answer against the corpus it claims to cite. Use when asked to review, critique, sanity-check, or "give skeptical feedback on" an answer produced by Canon (or any retrieval-grounded system) — especially when the answer looks good. Assumes the answer is wrong until each claim is proven…
pocket-development
Execute Pocket implementation plans through bounded packets, delegated implementation, independent review, and phase handoff. Use when the user asks to execute a plan or dispatch its tasks.
pocket-pitching
Pre-grinding problem exploration. Use BEFORE pocket-grinding when the problem is unformed or needs exploration. Guides diverge→converge with structured brainstorming methods and independent advisor curation (advisor tool or advisor subagent fallback), then produces a pitch exploration doc. Trigger on…
bug-hunting
Use when fixing bugs, debugging failures, or proactively reviewing code for hidden bugs. Reactive mode: fix known bugs. Proactive mode: hunt for bugs in code. Enforces confirmed root cause before any fix.
evidence-based-development
Enforce evidence-based claims through file:line citations, P1/P2/P3 prioritization proportional to evidence, and the ASSERTION/EVIDENCE/VERIFIED pattern for behavioral claims before any recommendation. Use when gathering evidence, presenting findings, or making development decisions. This skill MUST be consulted…
model-sovereignty
This skill should be used when the user asks about "local models", "custom models", "fine-tuning", "self-hosting models", "model selection", "which model should I use", "data privacy and models", "LoRA", "RAG vs fine-tuning", "Ollama", "vLLM", or wants guidance on whether to build, host, or customise their own AI…