firstmate: Skill for Claude Code

.agents/skills/bootstrap-diagnostics/SKILL.md

bootstrap-diagnostics is a skill for Claude Code from kunchenguid/firstmate. It costs 172 tokens per session (3,194 once invoked), scanned A, original, MIT.

A response guide for handling startup checks that find missing tools, invalid settings, network problems, or authentication issues. It also sets rules for asking the user before installing anything or starting dependent work.

In plain words
What is it for?
Use it at the start of a session when bootstrap checks report a problem, to explain what is affected, request consent, install approved tools, and verify access.
Why use it?
It turns technical startup warnings into clear actions and prevents work from beginning with unavailable tools or broken access. It also avoids installing software without approval.

Skill for Claude Code

Written for Claude Code: user-invocable in frontmatter. Also seen: installed under .agents/ (shared by several agents); mentions AGENTS.md.

This is kunchenguid/firstmate's own configuration. It tells Claude Code how to work on firstmate itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything firstmate configures →

About the project

firstmate is an agent distribution that lets one coding agent coordinate a crew of autonomous agents working in separate git worktrees. It is for running parallel fixes, investigations, plans, and audits while receiving completed pull requests, merges, or reports through one supervising agent. The catalogue entries provide skills, hooks, instructions, and settings for operating this workflow.

kunchenguid/firstmate · 8,295 stars · on GitHub

Reuse

Borrowing it

Nothing to install: this file belongs to kunchenguid/firstmate. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/kunchenguid/firstmate/main/.agents/skills/bootstrap-diagnostics/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/kunchenguid/firstmate

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bootstrap-diagnostics

README.md
[![agentmods](https://agentmods.dev/badge/skills/kunchenguid/firstmate/bootstrap-diagnostics/github.svg)](https://agentmods.dev/skills/kunchenguid/firstmate/bootstrap-diagnostics)
Your own site
<a href="https://agentmods.dev/skills/kunchenguid/firstmate/bootstrap-diagnostics"><img src="https://agentmods.dev/badge/skills/kunchenguid/firstmate/bootstrap-diagnostics/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for bootstrap-diagnostics

Your own site · 80×15
<a href="https://agentmods.dev/skills/kunchenguid/firstmate/bootstrap-diagnostics"><img src="https://agentmods.dev/badge/skills/kunchenguid/firstmate/bootstrap-diagnostics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 172 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,194 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00172 $0.03194
Opus 5.5 $0.00069 $0.01278
Sonnet 5.5 $0.00034 $0.00639
Haiku 4.5 $0.00017 $0.00319

Measured 2d ago against content hash bdf323752aea, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

bootstrap-diagnostics scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/bootstrap-diagnostics/SKILL.md · 80 lines

How it starts

The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.

bootstrap-diagnostics

Handle each printed line as below, before dispatching work that depends on it. The line formats themselves are owned by bin/fm-bootstrap.sh's header; this playbook owns the response to actionable lines. The session-start rules in session-start-recovery still bind: detect, then consent, then install or upgrade - never change a tool the captain has not approved in this session - and no work is dispatched until the tools it needs are present and GitHub auth is good. When any diagnostic needs captain attention, report the plain consequence and requested action using AGENTS.md section 9's captain-facing translation contract; do not name the diagnostic label unless the captain needs to paste it into a command or issue.

  • MISSING: <tool> (install: <command>) - the tool is absent; list the missing tools to the captain with a one-line purpose each plus the printed install commands, wait for consent (one approval may cover the list), then run bin/fm-bootstrap.sh install <approved tools...>. An installed tool below its floor, or one missing a required capability, reports OUTDATED: instead.
  • OUTDATED: <tool> (installed: <version|unparseable>; requires <floor|capability>; upgrade: <command>) - the tool is present but below what this home needs, so it is an upgrade request, not an install. Report the installed version and the printed upgrade: command and wait for the same consent rule before running it; a printed command that is the tool's own installer means that tool ships no self-updater yet, so the upgrade reuses its install command. bin/fm-bootstrap.sh owns the floor policy, and never argue the floor down to whatever the home happens to have installed. For no-mistakes, the floor is 1.46.0 because this repo's PR gate requires structured pipeline attestation that older builds do not write. For treehouse, the requirement is treehouse get --lease support. For tasks-axi, the requirement also covers the separate feature probe (bin/fm-tasks-axi-lib.sh owns the definition); config/backlog-backend=manual only suppresses the verbose BOOTSTRAP_INFO: tasks-axi available fact, not this report. For quota-axi, bootstrap requires it because firstmate reads its current output directly before resolving every crew-dispatch profile array; without it, report the requirement and do not choose around an unexamined candidate.
  • PRESENTATION_UNAVAILABLE: lavish-axi ... - explain that visual presentation is unavailable and continue nonvisual work with plain-text decisions and reports; do not hold unrelated dispatch for installation consent. Do not use Lavish until it satisfies the floor owned by bin/fm-bootstrap.sh; when visual work needs it, request consent for the printed install or upgrade command, then rerun bootstrap to confirm compatibility before using it. Scout briefs check the same floor when scaffolded and ask for a text report instead of a Lavish loop, so scaffold a visual scout only after that rerun confirms compatibility.
  • MISSING_MANUAL: <tool> (instructions: <url>) - tell the captain why the tool is required and give them the printed instructions URL, but do not pass the tool to bin/fm-bootstrap.sh install; wait for the captain to complete the manual installation, then rerun session start to confirm the dependency is present.
  • BACKEND_INVALID: <name> (known: <names>) - the resolved runtime backend has no verified dependency or lifecycle contract, so do not dispatch work until the invalid FM_BACKEND or config/backend value is corrected to one of the listed backends.
  • NEEDS_GH_AUTH - ask the captain to run ! gh auth login (interactive; you cannot run it for them). This probe now arrives from the deferred network stage, so it is also how an unreachable network shows up: gh cannot validate its token offline and reports the same failure. Confirm reachability before asking the captain to re-authenticate a credential that may be fine.
  • NETWORK_CHECKS: <what did not complete>; rerun <command> - the deferred network stage itself could not finish, so the checks it names are simply unknown, not failed. Rerun the printed command; it is idempotent and re-derives every finding. A hit the ...s bound line means one of those checks is slow or unreachable - most often a remote secondmate host - and the stage stopped rather than letting it wedge; a recorded fleet lock holder changed line means lock line 1 no longer names the pid that requested the sweeps, because another session took the lock or this session re-anchored it, so they were skipped and belong to whichever session holds the lock now.
  • TANGLE: <remediation> - the primary checkout is stranded on a feature branch instead of its default branch; AGENTS.md section 8 explains why this guard exists and what it protects. The work is safe on that branch ref; restore the primary to its default branch with the printed git -C <root> checkout <default>, then re-validate that branch in a proper worktree. This is the only sanctioned firstmate-initiated git write to the primary, and it is a non-destructive branch switch that strands nothing.
  • STARTUP_MEMORY_BUDGET: invalid config/startup-memory-budget - <reason> - the visible startup-memory budget is not a safe one-line positive decimal file; do not infer the default or propagate it. Correct the local primary file, then rerun session start so the normal convergence path can deliver the validated value to secondmate homes.
  • CREW_DISPATCH: invalid config/crew-dispatch.json - <reason> - the optional dispatch profile file exists but failed low-cost bootstrap validation; stop profile-based dispatch, report the actionable error, and require correction of the malformed schema, unverified harness name, or invalid harness/effort pair rather than falling back around it or selecting a bad profile.
  • FLEET_SYNC: <repo>: skipped: <reason> - a benign one-off skip (offline, no origin, local-only); bootstrap continued, investigate only if it blocks work. A skip can also report the bounded fleet-refresh timeout (FM_FLEET_SYNC_BOOTSTRAP_TIMEOUT, or a fleet-size-aware default with a 20 second floor); a timeout never blocks startup. skipped: registry entry does not resolve to a delivery posture is the one skip that is not one-off: the clone is left alone on every bootstrap until data/projects.md is corrected, so run the printed bin/fm-project-mode.sh <repo> to read the refusal and fix the entry.
  • FLEET_SYNC: <repo>: recovered: <detail> - the clone had drifted onto a clean detached HEAD holding no unique commits and the sync self-healed it (re-attached the default branch and fast-forwarded); no action needed, it is reported only so the self-heal is visible.
  • FLEET_SYNC: <repo>: STUCK: on <state>, N commits behind <base> - needs attention - the clone is dirty, on a non-default branch, detached with unique commits, or diverged, so the sync left it untouched (never forcing or discarding); it will keep falling behind until you look. A loud STUCK, especially a growing N across bootstraps, means that clone needs hands-on attention; dispatch a crewmate or resolve it before it strands work.
  • HOME_SUMMARY: this home has never published state/home-summary.json or ... has not been republished since <stamp> - this home's structured summary publication has failed repeatedly, and the line carries the failure count and the newest recorded reason from state/.home-summary-refresh.log. Publication is deliberately best-effort, so it cannot change another session-start, spawn, teardown, or watcher-poll result, and the watcher runs it detached so a slow attempt cannot delay the liveness beacon. Read the named record for the recorded reasons, then reproduce with a direct bin/fm-home-summary-refresh.sh (no --best-effort, which is what keeps the failure quiet) so the refresh error reaches you. A recorded deadline means the complete refresh did not finish inside FM_HOME_SUMMARY_TIMEOUT, so inspect lock acquisition and producer completion before validation or publication, and fix the blocked phase rather than raising this load-bearing bound.

Read the full file on GitHub · 80 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago Changed · +3 lines · +3 tokens per session bdf323752aea
  2. 4d ago Changed · -1 lines · -16 tokens per session dc3a3a953e4a
  3. 7d ago Changed d977755dae4c
  4. 27d ago Changed 968ae87f4908
  5. 1mo ago Changed · +1 lines 78769f53179d
  6. 1mo ago Changed · +3 lines 6babab02592a
  7. 1mo ago Changed · +3 lines · +5 tokens per session 08ec5999344d
  8. 1mo ago Changed 32919518388b
  9. 1mo ago Changed · +2 lines 44df25f54d0c
  10. 1mo ago First seen · 69 lines · 180 tokens per session scan A 24178cac2d69

Subscribe to this mod's changes

bootstrap-diagnostics is a skill published in the GitHub repository kunchenguid/firstmate (8,295 stars, last pushed today), licensed MIT. It adds 172 tokens to every session and 3,194 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

debug-optimize-lcp

Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…

ChromeDevTools/chrome-devtools-mcp · 99 tokens

systematic-debugging

Use when debugging a failing test, build error, or runtime issue that isn't immediately obvious. Guides a 4-phase root cause analysis instead of random fix attempts.

open-metadata/OpenMetadata · 37 tokens

log-error-digest

Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or…

zebbern/claude-code-guide · 71 tokens

deck-retro

Run a fully local agent-deck retrospective over the user's own transcripts, Recall index and logs. Use when a user wants to find recurring failures or take their own finding from investigation through synthetic reproduction, a user-filed issue, a test-first fix and contributor PR handoff. Also use for weekly usage…

asheshgoplani/agent-deck · 86 tokens

cwv-optimizer

Diagnose and fix Core Web Vitals issues on AEM Edge Delivery Services pages. Goes deeper than generic CWV advice by understanding EDS-specific performance patterns including the 100KB LCP budget, E-L-D loading phases, block rendering behavior, and third-party script impact. Produces specific fixes for LCP, CLS, and…

adobe/skills · 112 tokens

incident-response-incident-response

Coordinate production incident triage, mitigation, investigation, recovery, and follow-up. Use when responding to outages or other incidents that require structured operational coordination.

rmyndharis/antigravity-skills · 36 tokens