Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/nguyenthienthanh/aura-frognpx agentmods add skills/nguyenthienthanh/aura-frog/bugfix-quickWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nguyenthienthanh/aura-frog/bugfix-quick)<a href="https://agentmods.dev/skills/nguyenthienthanh/aura-frog/bugfix-quick"><img src="https://agentmods.dev/badge/skills/nguyenthienthanh/aura-frog/bugfix-quick/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nguyenthienthanh/aura-frog/bugfix-quick"><img src="https://agentmods.dev/badge/skills/nguyenthienthanh/aura-frog/bugfix-quick.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 51 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium MCP Rug Pull · line 59 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 59 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Agent Snooping · line 83 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.00995 |
| Opus 5.5 | $0.00019 | $0.00398 |
| Sonnet 5.5 | $0.00009 | $0.00199 |
| Haiku 4.5 | $0.00005 | $0.00100 |
Grade A, and why
bugfix-quick scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI-consumed reference. Optimized for Claude to read during execution. Human-readable explanation: see docs/architecture/HIERARCHICAL_PLANNING.md or docs/getting-started/ depending on topic.
Quick Bugfix
For bugs only. Features/refactors → run-orchestrator.
Core Principle
NO FIXES WITHOUT ROOT CAUSE. Fix at SOURCE, not symptom.
Process (4 Steps)
| Step | Name | Agent | Statusline |
|---|---|---|---|
| S1 | Investigate | lead (inline) — uses Read/Grep/Bash to reproduce |
bugfix S1 |
| S2 | Test RED | tester — writes failing test |
bugfix S2 |
| S3 | Fix GREEN | architect / frontend / mobile (per artifact, via agent-detector) |
bugfix S3 |
| S4 | Verify | tester — runs full suite |
bugfix S4 |
Announce per step. When transitioning, surface to the user: ─── Step S{N} · {Name} ─── Dispatching {agent}…. Also update run-state.json#current_step (one of: investigate, test-red, fix-green, verify) and #active_agent so the statusline reflects reality.
1. Investigate
- Read error + stack trace
- Reproduce the bug
git log/git difffor recent changes- Trace backward: where did bad data originate?
- Context economy (
rules/core/context-economy.md) — Grep for the failing symbol first, then Read withoffset+limiton the matched lines only. Don't read the full file unless the bug spans it.
2. Write Failing Test (RED)
- Test that reproduces the bug exactly
- Pick the right layer (
skills/test-writer/SKILL.md#test-type-selection). If the bug is a UI / user-flow / auth / payment regression → e2e spec via Playwright MCP, not a unit test that won't actually reproduce it. If the bug is in pure logic → unit. The test must fail for the right reason. - User confirms test FAILS
3. Fix (GREEN)
- Minimal, focused change at root cause
- User confirms test PASSES
4. Verify
- Run full test suite — and the e2e suite if S2 wrote an e2e spec (
npx playwright test/npx cypress run). No regressions in either. - Read output, THEN claim result. "Tests passed" with no pass count =
0 tests collected= bug. - Wrong: "Should work now" / Right: "Tests pass: [output]"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 93 lines · 47 tokens per session scan A 9c0fa18d0c4f
bugfix-quick is a skill published in the GitHub repository nguyenthienthanh/aura-frog (25 stars, last pushed 19d ago), licensed MIT. It adds 47 tokens to every session and 995 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
08-debug
Reproduce and fix a known bug, or find an unknown root cause by hypothesis validation. Use when the user wants to fix a bug, find why something breaks, or reopen a stuck investigation. Not for building a feature or reviewing a diff.
openspec-plus-tdd
MANDATORY skill that activates whenever code is written to implement an OpenSpec change task. Triggers: openspec-plus-apply is active, /opsx-apply is running, the user is implementing tasks from an OpenSpec change, an implementer subagent dispatched by openspec-plus-apply is starting work, or the user invokes phrases…
vitest-standard
Comprehensive unit testing expertise covering Vitest, test-driven development (TDD), mocking strategies, and production-grade best practices. Activates ONLY for unit testing scope (unit tests, integration tests, Vitest, TDD, Red-Green-Refactor, mocking, stubbing, spying, test coverage, and test architecture in…
bugfix
Quality bug fixes (P1/P2). Full TDD cycle, branch from master via feature/, no production deploy.
aicrew-fix
Run the aicrew /fix fast bug fix flow in Codex (triage -> root cause -> TDD -> verify).
testing
A guide to software testing, including unit tests for small pieces of code, integration tests for connected parts, and functional tests for complete behaviours. It also explains TDD, a method where tests are written before the code.