Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add neuromechanist/research-skills --skill debugginggit clone --depth 1 https://github.com/neuromechanist/research-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/neuromechanist/research-skills/debugging)<a href="https://agentmods.dev/skills/neuromechanist/research-skills/debugging"><img src="https://agentmods.dev/badge/skills/neuromechanist/research-skills/debugging/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/neuromechanist/research-skills/debugging"><img src="https://agentmods.dev/badge/skills/neuromechanist/research-skills/debugging.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 80 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.01496 |
| Opus 5 | $0.00045 | $0.00748 |
| Sonnet 5 | $0.00018 | $0.00299 |
| Haiku 4.5 | $0.00009 | $0.00150 |
Grade A, and why
debugging scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Debugging
A disciplined root-cause loop. The goal is a stated causal mechanism with proof, then a fix verified by the exact check that first exposed the problem. Never fix by guessing, and never make a symptom disappear without knowing why.
The loop
- Reproduce. Run the failing thing yourself and capture the exact error, command, and environment. If you cannot reproduce, stop and gather the reporter's exact conditions; do not fix blind. Side observations found on the way get noted and set aside, not chased.
- Trace the intended path. Before reading logs, read the code/docs to state what SHOULD happen, step by step. You cannot recognize the broken step without knowing the intended sequence.
- Check live state. What is actually on disk, in the database, running as a process, deployed? A grep that finds no trace of a migration is not proof it never ran; completed one-off scripts are routinely deleted. Absence in code is not absence in reality.
- Find the smoking gun. Logs, CI runs, git history. Cheapest checks first: installed version vs latest, the artifact's own declared type or config, the library's supported list. Only conclude "unsupported" or "impossible" after checking the declared capability directly.
- Prove the mechanism. Confirm with a live probe, not log trust (example: the blob that returned 403 in the failing run returns 200 now, so it was a permission-timing issue, not missing data). A differential test beats an assumption: when two configurations should differ, run both and compare.
- Only now read source for the WHY, and state the cause in one sentence with the evidence that proves it, plus what changes AND what deliberately does not change because it was not the cause.
- Fix, minimally. Fix the upstream cause, not the symptom (a service that dies when the machine sleeps needs the sleep addressed, not a restart loop).
- Verify with the original failing check, unchanged. Then run the wider gates (tests, lint, typecheck). Add a regression test that would have caught this bug. If recovery of live state was part of the fix, its success doubles as diagnosis confirmation.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 118 lines · 90 tokens per session scan A f7e77724118b
debugging is a skill published in the GitHub repository neuromechanist/research-skills (45 stars, last pushed 7d ago), licensed BSD-3-Clause. It adds 90 tokens to every session and 1,496 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
godot-debugging
Use when debugging Godot projects — remote debugger, print techniques, signal tracing, common error patterns and fixes.
beehave
Use when using the Beehave addon — pure-GDScript behavior trees with composites, decorators, leaves, a blackboard, and a visual runtime debugger.
systemic-issue-triage
Trigger: new issue, bug report, triage, backlog, issue flood, community report, root cause, dead-end, blocked user. Attack issues by root class, never one-by-one; fixes must shrink the system, not grow it.
agents-sdk-dotnet-debugging
Use when troubleshooting an agent built with the Microsoft Agents SDK (Microsoft.Agents.Hosting.AspNetCore and related packages) in C# / .NET. Trigger on any of these symptoms: build or C# compile errors, crashes on startup, 401 or auth errors on incoming requests, the bot not responding to messages, appsettings.json…
node-zombie-guardian
Use when diagnosing stale or orphaned Node.js processes launched by VCO, auditing ownership/liveness, or safely simulating cleanup without touching external Node workloads.
debug-live
Guides root-cause investigations with debugging capabilities by setting breakpoints, starting a debug session, stepping through execution, inspecting variables, and tracing symptoms back to their origin. Prefer it for runtime bugs, failing tests, exceptions, crashes, hangs, wrong/null values, and unexpected output…