Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mthines/agent-skills --skill ci-auto-fixgit clone --depth 1 https://github.com/mthines/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mthines/agent-skills/ci-auto-fix)<a href="https://agentmods.dev/skills/mthines/agent-skills/ci-auto-fix"><img src="https://agentmods.dev/badge/skills/mthines/agent-skills/ci-auto-fix.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 230 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 68 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00154 | $0.04308 |
| Opus 5 | $0.00077 | $0.02154 |
| Sonnet 5 | $0.00031 | $0.00862 |
| Haiku 4.5 | $0.00015 | $0.00431 |
Grade A, and why
ci-auto-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 370 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI Auto-Fix
Diagnose and fix a failed CI check, then verify it passes.
Generic across repositories; currently implements the GitHub Actions path via gh.
This SKILL.md is the orchestration index.
Load the matching rule file when you need detail — do not preload them.
| Phase | Goal | Required rule |
|---|---|---|
| 0 | Resolve the target (run ID / PR URL / auto-detect) | this file |
| 1 | Identify the failure (fetch logs) | this file |
| 2 | Read every workflow file before editing one | this file |
| 3 | Classify the failure with an explicit verdict | rules/verdicts.md + rules/self-improvement-loop.md (read lessons) |
| 3.5 | Write the plan artifact + run the confidence gate | rules/confidence-gate.md + templates/plan-artifact.md |
| 4 | Apply the minimal, targeted fix | this file + rules/anti-patterns.md |
| 5 | Verify locally before pushing | this file |
| 6 | Commit and push (rebase-safe) | this file |
| 7 | Wait for CI and capture the new result | this file |
| 8 | Iterate — with regression detection | rules/regression-detection.md + rules/self-improvement-loop.md (write on revert) |
| 9 | Report (structured exit summary) | this file + rules/self-improvement-loop.md (write on outcome) |
Always read rules/anti-patterns.md first.
The refusals apply to every phase.
Input
The user provides one of:
- A GitHub Actions check/run URL (e.g.
https://github.com/owner/repo/actions/runs/12345678) - A check run ID or workflow run ID
- A PR URL with failing checks (e.g.
https://github.com/owner/repo/pull/42) - Nothing — if
$ARGUMENTSis empty, auto-detect the failing CI for the current branch's PR (see Phase 0).
The argument is: $ARGUMENTS.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +1 lines 5891cbcdf03e
- 8d ago First seen · 369 lines · 154 tokens per session scan A 1b8072b234a8
ci-auto-fix is a skill published in the GitHub repository mthines/agent-skills (13 stars, last pushed today), licensed MIT. It adds 154 tokens to every session and 4,308 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
comet-github-ci-triage
A workflow for diagnosing failed GitHub Actions checks on a Comet pull request. GitHub Actions runs automated builds and tests; a pull request is a proposed code change waiting to be reviewed and merged.
k8s-yaml-validator
Comprehensive toolkit for validating, linting, and testing Kubernetes YAML resources. Use this skill when validating Kubernetes manifests, debugging YAML syntax errors, performing dry-run tests on clusters, or working with Custom Resource Definitions (CRDs) that require documentation lookup.
ci-cd-and-automation
Guides CI/CD pipeline design — quality gates, GitHub Actions for Go/TypeScript/PHP, feature-flag-decoupled deploys, secrets scoping, and pipeline optimization. Use when setting up or modifying a build/test/deploy pipeline, adding an automated quality gate, configuring CI secrets, or diagnosing a slow or flaky…
debugging-and-error-recovery
Enforces a stop-the-line triage protocol across failure classes — test failures, build breaks, runtime errors, and production incidents — using bisection, safe-fallback design, and instrumentation lifecycle management. Use when any unexpected failure appears and the question is "what class of failure is this and…
go-expert
Use when writing or reviewing Go code that starts goroutines, holds a sync.Mutex/RWMutex, or closes channels - to enforce goroutine lifecycle ownership, lock-hygiene, and channel-close-side rules, and to wire up the detection tooling (go test -race, go vet, go.uber.org/goleak) that catches violations tests alone…
security-analysis
Runs a two-pass vulnerability scan on a snippet, file, or diff — a static pattern pass across fixed categories (injection, secrets, auth, crypto, deserialization, path traversal, resource exhaustion), then an LLM-reasoning pass for business-logic and race-condition flaws the patterns can't catch. Use for a dedicated…