Comet is a resumable workflow and skill platform for coding tasks, covering requirements work as well as skill creation, evaluation, and release. It supports separate Native and Classic workflows and can coordinate implementation and verification across isolated Git worktrees. The catalogue contains skills and instructions that implement Comet-related workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rpamis/comet --skill comet-hotfixgit clone --depth 1 https://github.com/rpamis/cometWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rpamis/comet/comet-hotfix)<a href="https://agentmods.dev/skills/rpamis/comet/comet-hotfix"><img src="https://agentmods.dev/badge/skills/rpamis/comet/comet-hotfix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rpamis/comet/comet-hotfix"><img src="https://agentmods.dev/badge/skills/rpamis/comet/comet-hotfix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 3 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.05169 |
| Opus 5.5 | $0.00016 | $0.02068 |
| Sonnet 5.5 | $0.00008 | $0.01034 |
| Haiku 4.5 | $0.00004 | $0.00517 |
Grade A, and why
comet-hotfix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 256 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Comet 预设路径：Hotfix
开始或恢复任务前，必须先读取并遵守 comet-classic/reference/classic-layout.md。本文件中的 OpenSpec CLI 调用必须通过适配器执行，文件路径必须基于该协议绑定的 <classic-*> 逻辑根目录。
快速缺陷修复流程：open → build → 根因消除检查 → verify → archive。跳过 brainstorming 和完整实施计划，适用于修复已有行为、不需要设计新功能的场景。
适用条件（必须全部满足）：
- 修复已有功能的缺陷，不新增功能
- 不涉及接口变更或架构调整
- 改动范围可预估（文件数仅作提示，不会自动要求升级，见下方升级判定）
不适用：修复过程中如发现「升级判定」章节列出的变化，需要由用户决定是否改用完整 /comet-classic 流程。
流程（预设流程，6 步）
0. 设置输出语言
精简版 OpenSpec 产物必须使用 Comet 配置产物语言。.comet.yaml 尚不存在时依次读取项目 .comet/config.yaml 和全局 ~/.comet/config.yaml 的 classic.language，初始化后使用 comet state get <name> language 读取。
执行顺序：open → build → 根因消除检查 → verify → archive。Hotfix 预设各阶段的执行方式：创建必要文档后直接构建，检查根因是否消除，按规模选择验证方式，验证通过后进入归档前的最终确认。
开始前，按 comet-classic/reference/scripts.md 使用正式支持的 Comet CLI；从任意入口恢复任务时，先按 comet-classic/reference/context-recovery.md 检查 phase/workflow。
恢复已有 hotfix change 时，第一项状态操作必须是 comet state select <change-name>；创建新 change 时，在 .comet.yaml 初始化成功后立即运行该命令，再进入源码写入步骤。
进入 hotfix 工作区并读取当前状态 phase 后，运行 comet task <project-root> --task "<用户原始请求>" --phase "<phase>" --session "<本次任务稳定标识>" --json，按以下规则使用返回的上下文：
- 只将返回的
text加入当前上下文。Context Manifest（manifest/<context_manifest>）只包含摘要、应用原因和固定 ID；需要正文、来源或验证方式时，增加--expand-context "<id>"。路径、操作或阶段变化后，使用同一--session重新选择适用条目。 - 用户明确要求长期记住时，调用
comet memory remember ... --scope global|project。对于用户未明确要求记忆、但可重复采用且相对稳定的协作方式，才调用comet memory observe；不得保存任务摘要、进展、命令输出或测试结果。 - 任务结束前，将本次验证过且未来任务仍可复用的项目经验写入项目记忆：
comet knowledge remember <project-root> --title "<简明标题>" --text "<现象、做法、验证结果>" --type <fact|decision|pattern|procedure|constraint|failure-resolution> --json。同一标题默认更新已有条目；没有可复用经验时跳过，任务摘要、一次性命令输出和未验证的猜测不得写入项目记忆。 - 实际使用某条记录、且使用结果已经明确后，取
applications[].applicationId（Hook 文本中的application_id），运行comet task <project-root> --task "<用户原始请求>" --application "<application-id>" --outcome used-successfully|ignored|overridden|corrected|contributed-to-failure --json，记录使用结果。 - 任务结束前完成一次学习检查：有明确后续复用条件的用户纠正、偏好或协作习惯先调用
comet memory observe，再在完成命令中传--learning-check submitted；确认没有合格观察时传--learning-check no-observation，没有执行检查时传--learning-check not-run。观察 JSON 的learning.result和status.learning.lastCheck用于区分候选、晋级、去重和跳过；不要提交任务摘要或测试结果。 - 任务结束时，仍须运行带
--complete --workflow <workflow> --change <change-id> --learning-check submitted|no-observation|not-run的comet task。没有 Hook 时，由本 Skill 调用相同接口；comet memory context只作为兼容入口。插件失败不阻断缺陷修复。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago Changed · -2 lines 8edc446380f3
- 28d ago Changed · +1 lines 9cccae60beee
- 29d ago Changed · +21 lines 5783a680f6d9
- 1mo ago Changed · +21 lines · +11 tokens per session f10b94c365d2
- 1mo ago Changed · +2 lines 4de92db4812c
- 1mo ago First seen · 213 lines · 29 tokens per session scan A a429313c07dd
comet-hotfix is a skill published in the GitHub repository rpamis/comet (3,211 stars, last pushed today), licensed MIT. It adds 40 tokens to every session and 5,169 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
issue-analyze
GitHub Issue and PR review thread deep analysis with Codex blind verdict. Use when: analyzing issue root cause, classifying problems, investigation planning, triaging PR review comments for actionability. Not for: fixing bugs (use bug-fix), code exploration (use code-explore). Output: classified analysis + verdict…
code-explore
Pure Claude code investigation. Use when: tracing execution paths, understanding architecture, diagnosing issues. Not for: dual-perspective review (use code-investigate), code review (use codex-code-review). Output: analysis report with findings.
debug
Interactive debugging workflow with hypothesis-driven probe loop. Use when: unknown bugs, script errors, silent failures, troubleshooting. Not for: known bugs (use bug-fix), GitHub issue analysis (use issue-analyze), code understanding (use code-explore). Output: debug report with probe journal + root cause + fix.
code-investigate
Dual-perspective code investigation. Use when: deep code analysis needing both Claude and Codex perspectives. Not for: quick exploration (use code-explore), code review (use codex-code-review). Output: integrated findings from dual analysis.
git-investigate
Git history investigation. Use when: tracking code changes, finding where bugs were introduced, root cause analysis. Not for: code exploration (use code-explore), issue analysis (use issue-analyze). Output: history trace + root cause report.
simplify
Wrap-up refactoring — simplify code, eliminate duplication, preserve behavior.