Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add promptdriven/pdd --skill pdd-buggit clone --depth 1 https://github.com/promptdriven/pddWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/promptdriven/pdd/pdd-bug)<a href="https://agentmods.dev/skills/promptdriven/pdd/pdd-bug"><img src="https://agentmods.dev/badge/skills/promptdriven/pdd/pdd-bug/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/promptdriven/pdd/pdd-bug"><img src="https://agentmods.dev/badge/skills/promptdriven/pdd/pdd-bug.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00786 |
| Opus 5.5 | $0.00022 | $0.00314 |
| Sonnet 5.5 | $0.00011 | $0.00157 |
| Haiku 4.5 | $0.00006 | $0.00079 |
Grade A, and why
pdd-bug scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 31 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PDD bug
Each area is one main chat. Step briefs are in steps/. ? = optional.
- story: reproduce, prompt-story → gate: approve
- prompt-pr: check, try? → approve, then gate: pr (PR 1: prompt, Story, tests), then ask
- code: build, verify, formal → gate: pr (PR 2)
Rules
- The main chat coordinates and talks with the person. It does not write code.
- Run each step in a new subagent, never reused, so verify never checks its own code. Give it its full brief at once: the step file and file paths, not the chat history. Then wait for it with one long time-out. Do not send small follow-up messages or use short waits.
- At a gate, show the result, ask the person, and stop. For changes, revise here and ask again.
- Write each link as its full URL (
https://…), never as a linked word. - Before an optional step, ask the person and wait for the answer: "Do you want to try it now? yes/no". In a run, run
<pdd> workflow askfirst. - At the story gate, start with one verdict line, then the details: "Verdict: the bug is in the PROMPT (its check fails on the issue's case).", "Verdict: the prompt is right; the bug is only in the CODE." or "Verdict: no prompt covers this yet; the bug can only be in the code." Give the full paths of the Story files. If a new prompt covers only this issue, say that a bigger "adopt PDD for this module" step can come later. You may offer: "You can also open it now with
pdd try <story>before the check." End with: "Reply 'I approve' here or runpdd workflow approve N, or tell me what to change." - Before PR 1, show the
Runtime checkline(s) with the report link(s) and the Try link, if any. Ask the person to try it and approve, or ask for changes. pdd opens PR 1 only after the approval. Then show the PR 1 link and ask: "Do you want the code PR now, or stop here and merge PR 1 first? To make the code PR later, runpdd workflow approve N." The code area starts only when the person asks. - If verify or formal finds a failing case, go back to build in a new subagent, at most 2 times. If it still fails, PR 2 opens anyway with "✗ N vectors fail" on top. Say so at the gate.
- A person decides expected values. Never change a test to make it pass.
- Never push, open a PR or merge.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 31 lines · 55 tokens per session scan A dec82139ee8b
pdd-bug is a skill published in the GitHub repository promptdriven/pdd (920 stars, last pushed today), licensed MIT. It adds 55 tokens to every session and 786 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-28.
Other skills, from other repositories
code-runner
A sandboxed code execution tool that runs short programs without using your computer's files or network. It supports Python, JavaScript, TypeScript, Go, Rust, Java, C, C++, Ruby, and PHP.
systematic-debugging
Root-cause a bug with a hypothesis-driven loop instead of shotgun edits. Use when a bug isn't obvious after the first look, or when asked to "find out why" something fails.
sparc-methodology
SPARC (Specification, Pseudocode, Architecture, Refinement, Completion) comprehensive development methodology with multi-agent orchestration.
test-failure-explorer
Import and query an existing Vitest 3.2 JSON report to explore test failures, file-level errors and original diagnostic evidence.
developing-openrig
Use when changing OpenRig's own source in a clone of the openrig repository: finding which package or file owns a behaviour, choosing which tests to run, testing a change without disturbing the OpenRig daemon your own session runs on, judging whether a diff touches a high-risk area, or preparing a pull request. Not…
winapp-sandbox
Run, debug, and UI-automate a Windows app in a persistent Windows Sandbox rather than the user's desktop. Use for disposable app testing, guest diagnostics, file transfer, and app or whole-desktop evidence. Builds remain on the host; connection and reconnect can briefly take focus.