Borrowing it
Nothing to install: this file belongs to phase-rs/phase. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/phase-rs/phase/main/.claude/skills/bug-coverage-classifier/SKILL.mdgit clone --depth 1 https://github.com/phase-rs/phaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/phase-rs/phase/bug-coverage-classifier)<a href="https://agentmods.dev/skills/phase-rs/phase/bug-coverage-classifier"><img src="https://agentmods.dev/badge/skills/phase-rs/phase/bug-coverage-classifier/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/phase-rs/phase/bug-coverage-classifier"><img src="https://agentmods.dev/badge/skills/phase-rs/phase/bug-coverage-classifier.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 30 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.01837 |
| Opus 5.5 | $0.00040 | $0.00735 |
| Sonnet 5.5 | $0.00020 | $0.00367 |
| Haiku 4.5 | $0.00010 | $0.00184 |
Grade A, and why
bug-coverage-classifier scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://data.phase-rs.dev/preview/coverage-data.json" \ How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Coverage Classifier
What this skill is for
The actionable signal is supported_aspect_defect — a card claims to support the clause the user is reporting on, but the engine is still misbehaving. That is the bug worth filing.
Everything else is either already-known or out-of-scope:
unsupported_aspect— explicitly markedsupported: falseinparse_details. We already know it doesn't work. Defer unless the fix is trivial. No investigation needed beyond confirming the verdict.not_card_data_attributable— the bug is not about card text at all (combat assignment, AI behavior, UI, multiplayer, deckbuilder). Route to the relevant subsystem; the parser/effect-handler can't be the cause.cannot_determine— the report doesn't pin to any clause. Ask for clarification.
Spend your effort on supported_aspect_defect. That is where bugs actually live.
Inputs
card_name— the card the bug report names (e.g."Archon of Cruelty").bug_description— what the user said is misbehaving.
What to do
1. Look up the card
curl -s "https://data.phase-rs.dev/preview/coverage-data.json" \
| jq --arg n "<card_name>" '.cards[] | select(.card_name == $n) | {oracle_text, supported, parse_details}'
For repeat lookups in the same session, cache the full coverage JSON to a tmp file once and jq against the file.
If jq returns nothing, try common name normalizations: drop apostrophes (Bloodchief's Ascension → Bloodchief Ascension), try the front face of an MDFC, fix obvious typos. Consult triage/unknown-card-mapping.json for known corrections. If the name is flagged not_a_card (e.g. token types like "Blood Token"), return verdict not_card_data_attributable.
2. Identify which clause the bug is about
Read the bug description and match it to the parse_details node whose source_text describes the misbehaving line. The card name is already pinned, so you're choosing among at most a handful of clauses. Use natural-language judgement — bug reports use synonyms, abbreviations, and game-state examples ("X=3", "on end step", "with 2 counters") that won't always share vocabulary with the Oracle text.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 119 lines · 100 tokens per session scan A 7ad1dbe09f8f
bug-coverage-classifier is a skill published in the GitHub repository phase-rs/phase (312 stars, last pushed today), licensed Apache-2.0. It adds 100 tokens to every session and 1,837 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
testing-rules
Testing standards — frameworks, the testable-logic trigger, golden/snapshot rules, mocking rules, and the test-author → testing-reviewer pipeline. Load for /add-tests and any change that touches testable logic.
author-contract
Shared write-side contract every domain AUTHOR imports — smallest-diff implementation, ground-first, validation gates, tests-are-blocking, and never-approve-your-own-work. The write-side mirror of token-efficiency. Load at the start of any implementation task.
performance-checklist
Performance review checklist — hot paths, async-runtime discipline, streaming, query-client tuning, layout pre-measurement, token/cost. Load when reviewing perf-sensitive changes.
coding-standards
General repo rules enforced by ESLint/TypeScript/CI — PRs-only, never bypass lint, import ordering, type imports, path privacy, commit format. Load for any code change.
systematic-debugging
4-phase systematic debugging methodology with root cause analysis and evidence-based verification. Use when debugging complex issues.
verify-changes
Prove code works by running it, not just checking it exists. Verification through execution rather than inspection. Use after writing or modifying code to ensure it actually functions correctly.