agentmods.dev

bug-fix

A workflow step for finding the cause of a PHP bug and implementing a fix in php-src, the source repository for the PHP language. It uses the recorded reproduction and updates the bug's SPEC.md plan and status.

In plain words
What is it for?
Use it after a bug has been reproduced to analyze the root cause, plan file-level changes, edit PHP's C source, rebuild PHP, and make the new .phpt regression test pass.
Why use it?
It connects the failing test to a specific C function and file, then records the intended and completed changes. This reduces the risk of patching symptoms without confirming the cause.

Skill for Claude CodeCodex

8 3mo ago A scan 113 tokens original MIT
View the source file pronskiy/php-src-developer
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/pronskiy/php-src-developer/bug-fix
Any agent
npx skills add pronskiy/php-src-developer --skill bug-fix
Clone the repo
git clone --depth 1 https://github.com/pronskiy/php-src-developer

Made for: Claude Code, Codex.

Per session 113 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,473 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00113 $0.03473
Opus 5 $0.00056 $0.01736
Sonnet 5 $0.00023 $0.00695
Haiku 4.5 $0.00011 $0.00347

Measured yesterday against content hash c8ad33d01529, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

bug-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/php-core-developer/skills/bug-fix/SKILL.md · 268 lines

How it starts

The opening of the file, as written. The whole thing — 268 lines — stays where its author put it; the contents beside it link to each section on GitHub.

bug-fix

Third step of the bug-fix flow. Owns two phases: Analysis & Plan and Implementation.

Inputs

  1. SPEC.md in the task directory resolved per _shared/task-dir.md (env var → .current → cwd), type: bug, Reproduction phase done.
  2. $PHP_SRC_DIR with built sapi/cli/php.
  3. The failing .phpt recorded under the Reproduction phase steps.

What it produces

  • C-code changes under $PHP_SRC_DIR/{Zend,main,ext,sapi,...} as required.
  • Updated SPEC.md: Analysis & Plan and Implementation phases populated and done.
  • A rebuilt sapi/cli/php and a passing new .phpt.

Phases owned

Analysis & Plan

Steps:

  • root-cause — pin the offending function / file / line, write a paragraph explaining the mechanism. Cite specific paths.
  • plan-1, plan-2, … — one step per intended file-level change. Each names a concrete file + the change in 1–2 sentences.

Post-guardrail: every plan step references a concrete file path.

Implementation

Steps:

  • impl-1, impl-2, … — one per plan-N. Records what was actually changed (path:line, brief diff summary).

Post-guardrails:

  • make -j$(nproc) exits 0
  • sapi/cli/php run-tests.php <new-test> PASSES

Workflow

1. Pre-guardrails

  • SPEC.md type: bug, Reproduction phase done, new .phpt recorded.
  • Refuse if any of the above is missing; point the user at /bug-reproduce-test.
  • Research phase soft-check: if Research phase exists with status todo, print one warning line and proceed: 
    ⚠ Research phase still todo. Run /research first for prior-art (or mark it `skipped` in SPEC.md).
    done, skipped, or blocked → no warning.

2. Locate the root cause

Consult the Research phase first if it is done. Often it has already pinned the regression commit (git-log step) or surfaced a maintainers' discussion that names the offending function. Cite the relevant Research finding in the root-cause step body — Per Research's git-log step, commit a1b2c3d is the regression source: it added the BOTH branch but missed the USE_KEY branch.

Read the full file on GitHub · 268 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 268 lines · 113 tokens per session scan A c8ad33d01529

Subscribe to this mod's changes

bug-fix is a skill published in the GitHub repository pronskiy/php-src-developer (8 stars, last pushed 3mo ago), licensed MIT. It adds 113 tokens to every session and 3,473 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

DebuggingPlanningTesting
Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

babysit-pr

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…

openai/codex · 114 tokens

imagegen

Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…

openai/codex · 113 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens