Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ryanzhao1011/workframe --skill systematic-debugginggit clone --depth 1 https://github.com/ryanzhao1011/workframeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ryanzhao1011/workframe/systematic-debugging)<a href="https://agentmods.dev/skills/ryanzhao1011/workframe/systematic-debugging"><img src="https://agentmods.dev/badge/skills/ryanzhao1011/workframe/systematic-debugging/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ryanzhao1011/workframe/systematic-debugging"><img src="https://agentmods.dev/badge/skills/ryanzhao1011/workframe/systematic-debugging.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00131 | $0.02218 |
| Opus 5.5 | $0.00052 | $0.00887 |
| Sonnet 5.5 | $0.00026 | $0.00444 |
| Haiku 4.5 | $0.00013 | $0.00222 |
Grade A, and why
systematic-debugging scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
系统化调试技能
产物去向
RCA / 调试结论默认只在响应中呈现。需要留痕时：修复本身进 commit message；
值得跨需求复用的根因结论按 skill: document-norms §1 落 <sub>/decisions/；
线上故障走 projects/issues/BUG-*.yaml。不默认写文件。
适用场景
- @dev 收到 Bug/Issue 报告时（来自 @qa、用户反馈、线上监控等）
- 禁止"头痛医头脚痛医脚"式的随意修改
核心原则
先理解，再修复。修复前必须能回答三个问题：
- 为什么会出现这个 Bug？（根因）
- 这个修复会不会引入新 Bug？（影响面）
- 修复后如何验证确实修好了？（回归）
五步流程
第 1 步：复现确认
目标：确认问题存在且能稳定复现。
| 步骤 | 动作 |
|---|---|
| 读取 Issue | 从 projects/issues/{issue-id}.yaml 读取问题描述、复现步骤（issue-id 是全局唯一扁平 ID，例：BUG-001 / SEC-001；issues 目录是扁平结构，不按模块分子目录） |
| 解析归属 | 读取 Issue 的 area / module / component / spec_ref 字段，决定影响面分析的起点（例：area=backend, module=auth 提示先排查 auth 模块代码与相关 spec） |
| 构造复现条件 | 按 Issue 描述构造输入数据、执行环境、操作序列 |
| 执行复现 | 运行并观察实际输出 vs 期望输出 |
| 复现结论 | ✅ 能稳定复现 / ⚠️ 偶发 / ❌ 无法复现 |
如果无法复现：
- 向 Issue 报告者询问更详细的复现步骤
- 检查环境差异（版本、配置、数据）
- 不要立即关闭 Issue——保持
status: open，把「待补充的复现信息」写进 issue 的复现步骤/描述字段（issue schema 无 tags 字段，见projects/issues/TEMPLATES.md）
第 2 步：根因分析（RCA）
目标：定位问题代码并理解"为什么会出错"。
## 根因分析
### 症状
{Bug 的外在表现}
### 触发路径
{代码执行的调用链：A → B → C → 出错}
### 根因
{具体哪行代码、哪个逻辑导致问题}
### 为什么会写成这样
{原作者的意图 / 遗漏的边界条件 / 错误的假设}
### 为什么之前没暴露
{之前的使用场景为何没触发此问题}
第 3 步：影响面评估
目标：评估修复可能波及的其他模块（Blast Radius）。
| 评估维度 | 说明 |
|---|---|
| 代码依赖 | 谁调用了这段出错代码？改动后他们会受影响吗？ |
| 数据影响 | 修复会改变数据结构/存储吗？老数据需要迁移吗？ |
| 接口变更 | 是否改变了对外 API 行为？调用方需要知晓吗？ |
| 性能影响 | 修复引入的新逻辑是否影响性能？ |
| 安全影响 | 修复是否引入新的安全隐患？ |
第 4 步：修复与自测
目标：执行修复并验证修复有效。
- 实施修复：最小范围修改，不做无关重构
- 复现步骤重跑：确认原问题不再出现
- 边界测试：测试修复逻辑的边界条件（空值、极值、并发等）
- 影响面验证：对 Step 3 识别的影响模块做快速验证
第 5 步：回归标注
目标：为 @qa 标注此次修复的回归测试要点。
三个桶按什么分：广度来自同族边界三问——这个事实还有几份副本？这个约定还有几个使用方？周边还有哪些同类条目没碰到？答得出的进「必测」，搜到但没把握的进「建议测」，只是同族、本次没碰的进「关注点」。
与本 skill 第 3 步影响面五维互补不重合：五维按技术维度切、产出影响清单；三问按「同一事实的多处存在」切、产出测试范围。两组都要过。
标到多深，先定档（三问全部问完，命中取最高档；答「是」或「说不准」都算命中）：① 错了会不会传出这个文件之外 → 至少档 2 ② 有没有东西会因你改的那部分内容产出可比较的结果（通过/不通过、分数、diff、快照）→ 至少档 3 ③ 改的对象本身的职责就是「判断别的东西对不对」吗 → 档 4；全不命中 → 档 1。档 1 只验主路径与一致性，每升一档累加：引用面核对 → 跑真实消费方并排对照 + 边界矩阵 → 用它自己的失败方式打一遍（档 4 广度还要加上「同契约的其他实现」）。
详表与反例在
test-scoping.md（能读到插件目录时："$(cat .workframe/state/plugin-root.txt)/skills/test-case-design/reference/test-scoping.md"）；读不到是常态，上面三问已够定档。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago Changed · +5 lines · +91 tokens per session 09ea22d80174
- 1mo ago First seen · 157 lines · 40 tokens per session scan A 32d8574dd905
systematic-debugging is a skill published in the GitHub repository ryanzhao1011/workframe (7 stars, last pushed 24d ago), licensed MIT. It adds 131 tokens to every session and 2,218 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
check-cache-bugs
Audit Claude Code setup for cache bugs (CC#40524): sentinel, --resume/--continue, attribution header + ArkNill B3/B4/B5.
issue-triage
3-phase issue backlog management with audit, deep analysis, and validated triage actions. Use when triaging GitHub issues, sorting bug reports, cleaning up stale tickets, or detecting duplicate issues. Args: 'all' to analyze all, issue numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit only.
eval-rules
Audit .claude/rules/ files for structural correctness, glob validity, and real-world usefulness. Resolves each paths: pattern against actual project files, then asks the user whether each rule is still relevant and useful. Can update rules in-place based on answers. Use when setting up rules for the first time…
debug
Use when encountering any bug, test failure, unexpected behavior, or performance regression — before proposing any fix. Root-cause discipline plus a feedback-loop method; applies at every tier.
pentest-forensics
Digital forensics — evidence acquisition, memory/disk imaging analysis, timeline reconstruction, IOC extraction advisory. Triggers on forensics, DFIR, Volatility, memory analysis, disk image, Autopsy, FTK, timeline, IOC extraction, evidence chain, log analysis.
pentest-malware
Malware analysis — triage, static analysis, dynamic sandbox, IOC extract, YARA signature writing advisory. Triggers on malware analiz, malware triage, sandbox, Cuckoo, IDA, Ghidra, dynamic analysis, IOC, YARA imza, packer, unpacker, reverse malware.