Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nearform/lastlight --skill fixinggit clone --depth 1 https://github.com/nearform/lastlightWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nearform/lastlight/fixing)<a href="https://agentmods.dev/skills/nearform/lastlight/fixing"><img src="https://agentmods.dev/badge/skills/nearform/lastlight/fixing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nearform/lastlight/fixing"><img src="https://agentmods.dev/badge/skills/nearform/lastlight/fixing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 210 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.03738 |
| Opus 5.5 | $0.00018 | $0.01495 |
| Sonnet 5.5 | $0.00009 | $0.00748 |
| Haiku 4.5 | $0.00005 | $0.00374 |
Grade A, and why
fixing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 282 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Fixing
building is about implementing. This is about a failure that already
happened: find out why, decide whether it can be fixed here at all, and only
then repair it — minimally.
The discipline is diagnose-first. A blind second attempt on a PR whose tests need a database, or whose base branch is already red, spends a full install and test cycle to learn nothing. So you classify first and repair second.
The procedure
1. Read the real failure. Start from the structured CI report in your
prompt. When an excerpt is inconclusive, pull the full job log with
github_get_job_logs. When the harness could not download the logs at all your
prompt says so explicitly, and names the reason — say so in your verdict too,
and do not invent a cause from an annotation that was truncated.
The prNumber in your prompt is your target, and its head is already
checked out. Do not call github_list_pull_requests to "find" or "confirm"
it; you were handed it, and listing dumps every open PR for nothing.
2. Read the CI definition. .github/workflows/*.yml is already in the
checkout (the harness pre-cloned the PR head). Extract, per failing job: runner
OS, toolchain versions (setup-node, setup-python, matrix entries), the
exact commands, services:, env: and which secrets they reference, cache
config, and install flags (npm ci, --frozen-lockfile).
3. Name the differences between CI and this sandbox — explicitly. Toolchain
version (node -v against the workflow's), OS, absent services (postgres,
redis), absent secrets, no browser on the lean image, the egress allowlist. This
is the step that turns "the tests fail" into "the tests fail here because
CI runs Node 22 and this sandbox is on Node 20". Write the comparison down even
when it comes out empty — "no relevant difference" is itself a finding.
4. Reproduce. Run the exact failing command, aligned to CI's toolchain
where you can (fnm use <version> read from the workflow file). Install first
per the building skill.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 282 lines · 46 tokens per session scan A dac877e7e63b
fixing is a skill published in the GitHub repository nearform/lastlight (39 stars, last pushed 9d ago), licensed MIT. It adds 46 tokens to every session and 3,738 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
GitHub CI Fix Debugging
Debug and fix failing GitHub PR checks by inspecting GitHub Actions logs, summarizing failure context, drafting fix plans, and implementing fixes after approval.
investigate
Investigate a specific issue report with strict, evidence-driven diagnosis.
meta-long-running-build-watchdog
Watches a long-running command via tmux, lets sub-agent diagnose failures and propose a fix, and records the diagnosis to memory. Designed for overnight model fine-tunes, CI image builds, or repeated regression suites that may fail intermittently.
ci-troubleshoot
Diagnose failed GitHub Actions runs for pi-agent-dashboard: the 11-file workflow taxonomy, affected-test selection, the release pipeline, known failure modes, and how to read gh run logs and retrigger jobs. Use when a CI run is red, a release is stuck, a workflow won't dispatch, or you need to know which workflow does…
memory-safety-c-cpp
Reference vocabulary for memory-safety vulnerabilities in native C/C++ code — bug-class taxonomy, common arithmetic patterns that lead to corruption, dispatch-family discipline, type-confusion idioms, use-after-free patterns, and exploitability factors. Read when analyzing, hypothesizing, designing harnesses for, or…
orca
Use when the user asks to run an Orca flow (e.g. "use orca to implement …"), or when delegating a well-defined implementation task to Orca's autonomous multi-agent flow — a headless plan-code-review CLI to hand a coding task to instead of implementing it yourself.