Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lightninglabs/wavelength --skill bug-reportgit clone --depth 1 https://github.com/lightninglabs/wavelengthWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lightninglabs/wavelength/bug-report)<a href="https://agentmods.dev/skills/lightninglabs/wavelength/bug-report"><img src="https://agentmods.dev/badge/skills/lightninglabs/wavelength/bug-report/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lightninglabs/wavelength/bug-report"><img src="https://agentmods.dev/badge/skills/lightninglabs/wavelength/bug-report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Data Exfiltration · line 247 Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.Fix: Remove any code that sends prompts, responses, or session data externally. Preserve user privacy; never exfiltrate conversation content.
- medium Rogue Agent · line 41 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00096 | $0.03601 |
| Opus 5.5 | $0.00038 | $0.01440 |
| Sonnet 5.5 | $0.00019 | $0.00720 |
| Haiku 4.5 | $0.00010 | $0.00360 |
Grade A, and why
bug-report scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
BACKEND_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \ How it starts
The opening of the file, as written. The whole thing — 381 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Report
Collect runtime state from the current waved test session and file a structured GitHub issue against this repository.
Body discipline (read before collecting anything)
The point of this skill is to give the team a report they can act on in under a minute, not a dump of everything the daemon knows. Target the final issue body at ≤ 5 KB / ~100 lines. If a section is bigger than the failure it's documenting, trim it.
Concrete rules:
- The body leads with what failed and why (Summary + Failure sequence), not with environment metadata.
- The "Failure sequence" is a curated excerpt of the log — the 5–10 lines that actually trace the bug. Strip routine state-machine ticks, polling loops, and unrelated subsystems.
- The full session log goes in a gist, not in the body (see step 8a). The body links to it. If gist upload fails, note the local log path and stop — do not paste hundreds of lines inline.
- Wallet state: only the failing entry's relevant fields. Do not paste
the whole
listJSON. - Environment: platform + arch + go version + daemon commit + network
- wallet backend. Not the full
uname -srvm, not PID, not IPv6 address unless the bug is network-layer.
- wallet backend. Not the full
- Reproduction steps: write the actual steps that produced the bug. If the only honest thing you can write is a TODO, ask the user before filing.
- Cut secondary observations into separate issues. One issue, one bug.
Steps
1. Get the description
If the user provided an argument, use it as the issue title. If not, ask for one sentence describing what went wrong before collecting anything.
2. Detect the active network and chain backend
Do not assume a network (mainnet/testnet/signet/regtest/simnet) or a chain backend (lwwallet+Esplora / btcwallet+neutrino / lnd). Detect both from config first, then cross-check against the most recent daemon log.
CONF=~/.waved/waved.conf
# Helper: read a key from the conf file (uncommented), strip whitespace and
# surrounding quotes. Returns empty if missing.
conf_get() {
grep -E "^[[:space:]]*$1[[:space:]]*=" "$CONF" 2>/dev/null \
| tail -1 | cut -d= -f2- \
| sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//; s/^"(.*)"$/\1/'
}
# Config-derived values. Defaults match waved/config.go:
# network defaults to mainnet, wallet.type defaults to lwwallet.
NETWORK=$(conf_get network)
NETWORK=${NETWORK:-mainnet}
WALLET_TYPE=$(conf_get wallet.type)
WALLET_TYPE=${WALLET_TYPE:-lwwallet}
# Cross-check against the actual log directory tree. If the config-derived
# network has no log file but another network's log does, prefer the
# directory that has a recent log — the operator may have switched
# networks without updating the conf, or the conf may be elsewhere.
LOG_ROOT=~/.waved/logs
LOG="$LOG_ROOT/$NETWORK/waved.log"
if [ ! -f "$LOG" ]; then
ALT=$(ls -t "$LOG_ROOT"/*/waved.log 2>/dev/null | head -1)
if [ -n "$ALT" ]; then
LOG="$ALT"
# Re-derive network from the directory name so the report is
# consistent with the log we actually read.
NETWORK=$(basename "$(dirname "$ALT")")
fi
fi
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 381 lines · 96 tokens per session scan A 6815a4911dfe
bug-report is a skill published in the GitHub repository lightninglabs/wavelength (55 stars, last pushed yesterday), licensed MIT. It adds 96 tokens to every session and 3,601 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
systematic-debugging
Use when debugging a failing test, build error, or runtime issue that isn't immediately obvious. Guides a 4-phase root cause analysis instead of random fix attempts.
log-error-digest
Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or…
deck-retro
Run a fully local agent-deck retrospective over the user's own transcripts, Recall index and logs. Use when a user wants to find recurring failures or take their own finding from investigation through synthetic reproduction, a user-filed issue, a test-first fix and contributor PR handoff. Also use for weekly usage…
cwv-optimizer
Diagnose and fix Core Web Vitals issues on AEM Edge Delivery Services pages. Goes deeper than generic CWV advice by understanding EDS-specific performance patterns including the 100KB LCP budget, E-L-D loading phases, block rendering behavior, and third-party script impact. Produces specific fixes for LCP, CLS, and…
incident-response-incident-response
Coordinate production incident triage, mitigation, investigation, recovery, and follow-up. Use when responding to outages or other incidents that require structured operational coordination.