Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/movebrickschi/harness-engineering-mcp/bugfix-flownpx skills add movebrickschi/harness-engineering-mcp --skill bugfix-flowgit clone --depth 1 https://github.com/movebrickschi/harness-engineering-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/movebrickschi/harness-engineering-mcp/bugfix-flow)<a href="https://agentmods.dev/skills/movebrickschi/harness-engineering-mcp/bugfix-flow"><img src="https://agentmods.dev/badge/skills/movebrickschi/harness-engineering-mcp/bugfix-flow.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00099 | $0.01195 |
| Opus 5 | $0.00049 | $0.00598 |
| Sonnet 5 | $0.00020 | $0.00239 |
| Haiku 4.5 | $0.00010 | $0.00120 |
Grade A, and why
bugfix-flow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
bugfix-flow
适用场景
线上/线下报告的 Bug、错误、栈追踪、"以前能用现在不行"。
前置条件
确认 _playbook.md Part B.3 启动参数；额外需要 bug_report（用户描述 / 截图 / 日志）。
流程步骤
阶段 0 · 上下文初始化
move_agent_to_root；建知识库目录（极简 META.md）；如有 _lessons.md 加载；用 /learn 检索"曾经修过类似问题"。
阶段 1 · 现象固化
prompt: "请提供 Bug 信息（可全选）："
options:
- "已粘贴报错堆栈/日志"
- "已提供复现步骤"
- "已提供截图/录屏"
- "需要我用 cursor-ide-browser 自己复现"
allow_multiple: true
把现象写入 BUG_REPORT.md：环境 / 步骤 / 实际 vs 预期 / 频率。
阶段 2 · 根因调查（强制 /investigate）
- 调用
/investigate走完 4 阶段（investigate/analyze/hypothesize/implement） - 铁律：未找到根因不许动手改代码
- 输出
RCA.md（模板见 _playbook.md Part E.10）
阶段 3 · 修复方案 + 卡点
prompt: "根因已确认（RCA.md），修复方案有几种："
options:
- "用方案 A（推荐）"
- "用方案 B（备选，更保守）"
- "需要更多调查（说明）"
阶段 4 · 写复现失败测试
git checkout -b fix/[short-slug]- 必须先写一个能复现 Bug 的失败测试，commit：
test(scope): 复现 [bug 摘要]
阶段 5 · 实施修复
/freeze锁定相关目录，避免"顺手清理"无关代码- 写最小修复 → 同一测试由红变绿 → commit：
fix(scope): 修复 [bug 摘要] /unfreeze
阶段 6 · 回归检查
/qaquick +/review- 跑
IMPACT_ANALYSIS.md列出的回归点 - 跑
/cso若涉及鉴权/数据可见性
阶段 7 · 上线
/ship（PR 描述带 RCA.md 链接）→ /land-and-deploy → /canary。
阶段 8 · 复盘
append _lessons.md：根因类型 / 怎么发现的 / 怎么避免再次发生。
错误处理
- 找不到根因 → 不允许"猜着改"，继续
/investigate或升级请求帮助 - 修复后回归测试失败 → 立即 revert 修复 commit，回阶段 2 重做调查
- "改完之后看似 OK，没有失败测试" → 不接受，要求补失败测试
产物清单
META.md、BUG_REPORT.md、RCA.md、复现失败测试 commit、修复 commit、/qa 报告、PR 链接。
支持的修饰符
无标准修饰符；可叠加 M4（如修复涉及数据修复脚本）→ 必须在 RCA.md 加"数据修复说明 + 回滚方案"。
与其他 skill 的关系
- 通常被
/dev-flow路由到（也可被用户直接触发） - 强依赖
/investigate - 自查：
/qa、/review、/cso - 上线：
/ship、/land-and-deploy、/canary
附录
- 通用基座：见 _playbook.md Part B
- 文档模板：见 _playbook.md Part E
- 完整索引：见 _playbook.md Part F
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 113 lines · 99 tokens per session scan A c40d6c44b445
bugfix-flow is a skill published in the GitHub repository movebrickschi/harness-engineering-mcp (2 stars, last pushed 3mo ago), licensed MIT. It adds 99 tokens to every session and 1,195 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
engram-testing-coverage
TDD and coverage standards for Engram. Trigger: When implementing behavior changes in any package.
tdd
Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.
test-first-bugs
Enforces a test-driven bug-fixing workflow. Use when a user reports a bug, failing code, an error, or asks to fix something.
mobiai-mobile-tdd
You MUST use this before writing any implementation code for a mobile feature, bug fix, refactor, or behavior change. Tests come before implementation — no exceptions.
white-box-red-testing
Find bugs by writing tests that should pass but don't. Invoke manually on user-chosen scope (commits, files, or coverage threshold). Outputs red tests with structured rationale. Use when user asks to "stress-test", "find bugs in", "attack", or "break" code.
refine-plan
Iteratively refine development plans using TDD methodology. Ensures plans are clear, actionable, and include red-green-refactor cycles with proper test coverage.