Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mgiovani/cc-arsenal --skill fix-buggit clone --depth 1 https://github.com/mgiovani/cc-arsenalWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mgiovani/cc-arsenal/fix-bug)<a href="https://agentmods.dev/skills/mgiovani/cc-arsenal/fix-bug"><img src="https://agentmods.dev/badge/skills/mgiovani/cc-arsenal/fix-bug/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mgiovani/cc-arsenal/fix-bug"><img src="https://agentmods.dev/badge/skills/mgiovani/cc-arsenal/fix-bug.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.02565 |
| Opus 5.5 | $0.00038 | $0.01026 |
| Sonnet 5.5 | $0.00019 | $0.00513 |
| Haiku 4.5 | $0.00009 | $0.00257 |
Grade A, and why
fix-bug scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 197 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Fix
Fix the bug the user describes. It might arrive as a plain description, sometimes as an issue ID, occasionally just the name of a failing test. Work test-driven: reproduce the failure first. Track down the root cause with evidence. Apply the smallest fix that resolves it, run the tests, commit.
Anti-hallucination guidelines
A fix that "should work" but was never run against a failing test is a guess, not a fix:
- Reproduce first: don't fix what you haven't seen fail.
- Test-driven: write or locate a failing test before implementing the fix; confirm it actually fails.
- Verify root cause: locate the bug with grep/read evidence (file path, line number), not intuition.
- Verify the fix: run the full test suite; all tests must pass before calling the bug fixed.
- No invented fixes: only implement solutions that address the demonstrated root cause.
- Reference real code: never make claims about code you haven't read.
Workflow Mode: Inline by Default
Most bugs are a single file, single root cause, fixable and verifiable in one sitting. For those, run Phases 0–5 below yourself, in order, inline: no task chain, no subagent fan-out. That's the default; don't create tasks unless the case below applies.
Use a task chain instead when the bug spans multiple files/components, the root
cause is unclear enough to need a dedicated analysis phase, or the fix will span
multiple sessions and needs progress tracking across them. In that case, before
Phase 0, create six tasks (Discovery, Reproduce & Analyze, Plan, Implement, Verify,
Commit) with a strict sequential chain, each addBlockedBy the one before it:
TaskCreate: { subject: "Phase 0: Discover project workflow", activeForm: "Discovering project workflow" }
TaskCreate: { subject: "Phase 1: Reproduce and analyze bug", activeForm: "Analyzing bug" }
TaskCreate: { subject: "Phase 2: Plan fix", activeForm: "Planning fix" }
TaskCreate: { subject: "Phase 3: Implement fix", activeForm: "Implementing fix" }
TaskCreate: { subject: "Phase 4: Verify quality", activeForm: "Verifying fix quality" }
TaskCreate: { subject: "Phase 5: Final commit", activeForm: "Creating final commit" }
TaskUpdate: { taskId: "2", addBlockedBy: ["1"] }
TaskUpdate: { taskId: "3", addBlockedBy: ["2"] }
TaskUpdate: { taskId: "4", addBlockedBy: ["3"] }
TaskUpdate: { taskId: "5", addBlockedBy: ["4"] }
TaskUpdate: { taskId: "6", addBlockedBy: ["5"] }
TaskUpdate: { taskId: "1", status: "in_progress" }
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 14d ago Changed · -1 lines df4886e7c323
- 24d ago Changed · +1 lines 975233edbe72
- 1mo ago Changed · +2 lines a1c79765b888
- 1mo ago First seen · 195 lines · 94 tokens per session scan A f090ec77d17b
fix-bug is a skill published in the GitHub repository mgiovani/cc-arsenal (8 stars, last pushed 12d ago), licensed MIT. It adds 94 tokens to every session and 2,565 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
rpa-bugfix
Run when the user invokes /rpa-bugfix together with a clear bug description (expected vs actual, reproduction). Reproduction test first, then fix, full test suite, short report. Will not work correctly without the bug details.
repro-first
Bug-fix mode that reproduces a bug in a failing test before changing any code. Entered with /repro-first.
red-green-refactor
Guides the red-green-refactor TDD workflow: write a failing test first, implement the minimum code to make it pass, then refactor while keeping tests green. Use when a user asks to practice TDD, write tests first, follow red-green-refactor, do test-driven development, write failing tests before code, or phrases like…
hatch3r-bug-fix
Step-by-step bug fix workflow. Diagnose root cause, implement minimal fix, write regression test. Use when fixing bugs, working on bug report issues, or when the user mentions a bug.
shisan-xinuo-roles
A set of defined agent roles for reviewing and carrying out software work, such as debugging, security checks, testing, risk review, contract checks, frontend review, and performance investigation.
debugging
A structured method for finding and fixing software bugs. It starts by writing a test that reproduces the failure, then investigates its underlying cause before making a small fix.