Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add QBall-Inc/the-bulwark --skill bug-magnet-datagit clone --depth 1 https://github.com/QBall-Inc/the-bulwarkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/qball-inc/the-bulwark/bug-magnet-data)<a href="https://agentmods.dev/skills/qball-inc/the-bulwark/bug-magnet-data"><img src="https://agentmods.dev/badge/skills/qball-inc/the-bulwark/bug-magnet-data/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/qball-inc/the-bulwark/bug-magnet-data"><img src="https://agentmods.dev/badge/skills/qball-inc/the-bulwark/bug-magnet-data.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 53 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.02704 |
| Opus 5 | $0.00019 | $0.01352 |
| Sonnet 5 | $0.00008 | $0.00541 |
| Haiku 4.5 | $0.00004 | $0.00270 |
Grade A, and why
bug-magnet-data scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- bug-magnet-data — 98% identical, 573 lines differ
How it starts
The opening of the file, as written. The whole thing — 290 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Magnet Data
Curated edge case test data for boundary testing, verification scripts, and test generation. 50+ years of testing wisdom distilled into small, high-signal collections organized by data type.
Core Principle: Curation beats generation. 50 well-chosen edge cases find more bugs than 10,000 random inputs.
When to Use This Skill
Load this skill when the consumer request matches ANY of these patterns:
| Consumer | Trigger | Usage |
|---|---|---|
| test-audit | Step 7 (edge case gap detection) | Identify missing boundary test coverage |
| bulwark-verify | Generating verification scripts | Inject edge cases into test scenarios |
| bulwark-fix-validator | Validating a fix | Test fix against boundary conditions |
DO NOT use for:
- Encrypted/compressed data (edge cases won't penetrate wrapping)
- Pure unit tests with fully mocked dependencies (edge cases need real execution)
- Performance/load testing (use dedicated load testing tools)
Pre-Flight Gate (BLOCKING)
STOP. Before providing ANY edge case data, you MUST follow the three-phase workflow.
This skill provides curated data through a deterministic workflow. You must execute all phases.
What You MUST Do
- Phase 1: Component Detection - Identify component type and load context file
- Phase 2: Data Loading - Load T0 + T1 data files (REQUIRED), T2 if specified by context
- Phase 3: Edge Case Application - Apply edge cases and report what was loaded
What You MUST NOT Do
- Do NOT generate edge cases from your own knowledge - use the curated data files
- Do NOT skip loading context files - they determine which categories apply
- Do NOT skip the safety filter - patterns marked
safe_for_automation: falsemust be excluded - Do NOT return partial data - all applicable tiers must be loaded
Why This Matters
The curated data exists because:
- Curation beats generation - 50 well-chosen edge cases find more bugs than 10,000 random inputs
- Reproducibility - Same component type = same edge cases every time
- Safety - Destructive patterns are explicitly marked and filtered
What ships with it
29 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- context/cli-args.md 1.8 KB
- context/db-query.md 2.4 KB
- context/file-contents.md 1.9 KB
- context/http-body.md 2.0 KB
- context/process-spawn.md 2.6 KB
- data/booleans/boundaries.yaml 2.9 KB
- data/collections/arrays.yaml 2.6 KB
- data/collections/objects.yaml 2.8 KB
- data/concurrency/race-conditions.yaml 3.7 KB
- data/concurrency/state-machines.yaml 3.5 KB
- data/dates/boundaries.yaml 2.8 KB
- data/dates/invalid.yaml 2.7 KB
- data/dates/timezone.yaml 2.7 KB
- data/encoding/charset.yaml 1.7 KB
- data/encoding/normalization.yaml 2.3 KB
- data/formats/email.yaml 3.1 KB
- data/formats/json.yaml 3.6 KB
- data/formats/url.yaml 3.2 KB
- data/language-specific/javascript.yaml 3.8 KB
- data/language-specific/python.yaml 3.8 KB
- data/language-specific/rust.yaml 3.5 KB
- data/numbers/boundaries.yaml 3.3 KB
- data/numbers/precision.yaml 2.0 KB
- data/numbers/special.yaml 1.5 KB
- data/strings/boundaries.yaml 2.4 KB
- data/strings/injection.yaml 5.0 KB
- data/strings/special-chars.yaml 3.7 KB
- data/strings/unicode.yaml 3.2 KB
- references/external-lists.md 3.0 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 290 lines · 38 tokens per session scan A 4516e0010958
bug-magnet-data is a skill published in the GitHub repository QBall-Inc/the-bulwark (8 stars, last pushed yesterday), licensed MIT. It adds 38 tokens to every session and 2,704 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
journey-simulation
Use when caller wants to observe how a stranger encounters a flow, artifact, or sandbox — triggers like "simulate a user journey", "test our onboarding / checkout / signup", "will my ICP convert", "how does a cold reader experience this README", "first-time user test", "cognitive walkthrough", or any request to…
black-box-test
Use as an INDEPENDENT tester agent to test another agent's intesting ticket from the OUTSIDE — never your own, and never from the implementation diff. You test from the operational test contract + acceptance criteria only (never HOW it was built), writing automated tests that invoke the changed surfaces and recording…
java-conventions
Use when a ticket adds or changes Java code and it must follow the repo's Java conventions — modern Java (records, sealed types, pattern matching, switch expressions), Optional discipline, immutability, Spring Boot constructor injection, and JUnit 5 + Mockito tests. Invoke for "add this in Java", "fix the Java build"…
python-conventions
Use when a ticket adds or changes Python code and it must follow the repo's Python conventions — PEP 8, full type hints, dataclasses, pythonic idioms, explicit error handling, and pytest with coverage. Invoke for "add this in Python", "fix the type/lint errors", "add the FastAPI/Django endpoint", or as the language…
add-integration-test
Use when a ticket asks for integration or end-to-end coverage across components — an API route hitting a database, a service-to-service call, a multi-step flow — rather than a single unit. Invoke for "test the endpoint end to end", "cover the checkout flow", or "verify the migration + query together".
add-unit-test
Use when a ticket asks for new unit tests, or when an acceptance criterion requires test coverage for a function/module/component and none exists. Invoke for "add tests for X", "cover the Y edge case", or raising coverage on a specific unit.