Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sd0xdev/sd0x-harness/bug-fixnpx skills add sd0xdev/sd0x-harness --skill bug-fixgit clone --depth 1 https://github.com/sd0xdev/sd0x-harnessWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.01246 |
| Opus 5 | $0.00024 | $0.00623 |
| Sonnet 5 | $0.00010 | $0.00249 |
| Haiku 4.5 | $0.00005 | $0.00125 |
Grade A, and why
bug-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Fix Skill
Trigger
- Keywords: bug, issue, fix, error, broken, failing
When NOT to Use
- New feature development (use feature-dev)
- Just want to understand code (use code-explore)
- Pure test-only tasks without feature changes (use
/codex-test-reviewdirectly)
Prohibited Actions
❌ git add | git commit | git push — per @rules/git-workflow.md
This skill fixes bugs but does not commit. /precommit is a quality gate only. To commit, the user must invoke /smart-commit --execute separately.
Workflow
Investigate → Locate → Fix → Test + Review → Precommit Gate
│ │ │ │ │
▼ ▼ ▼ ▼ ▼
gh issue Grep Edit /verify /precommit
/git-investigate Read tests /codex-test-review
/codex-review-fast
Phase 1: Investigation
Before fixing: if the bug maps to a feature under docs/features/, read
docs/features/<key>/intent-<key>.md when it exists — a fix that contradicts one of its INV-*
invariants or Non-goals stops and asks the user (cite the line). No identifiable feature →
nothing to load; proceed.
| Source | Action |
|---|---|
| GitHub Issue | gh issue view <number> |
| Error message | Grep("error message") |
| Code history | /git-investigate |
Output root cause analysis:
- Problem location:
src/<module>/<file>:<line> - Root cause:
- Impact scope:
Phase 2: Fix
| Principle | Description |
|---|---|
| Minimal changes | Only modify what is necessary |
| No new issues | Confirm changes don't affect other features |
| Design preserved | Choose the smallest root-cause fix that keeps current responsibilities. If the fix moves a boundary or adds an abstraction, say which shape you chose and why — "direct fix; existing design retained" is the expected common answer |
Phase 3: Add Regression Test ⚠️
Follow @rules/testing.md for conventions (AAA, naming, evidence model).
Follow @rules/testing-project.md for project-specific overrides.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 160 lines · 48 tokens per session scan A 42f3dc4e5861
bug-fix is a skill published in the GitHub repository sd0xdev/sd0x-harness (188 stars, last pushed 3d ago), licensed MIT. It adds 48 tokens to every session and 1,246 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
docx
当用户需要创建、读取、编辑或处理 Word 文档（.docx）时，使用此技能。触发场景包括提到“Word 文档”、“.docx”，或要求生成带目录、标题、页码、信头等格式的专业文档；也包括提取或重组 .docx 内容、插入或替换图片、在 Word 文件中查找替换、处理修订或批注，以及将内容整理为正式 Word 文档。如果用户要求生成“报告”“备忘录”“信函”“模板”等 Word / .docx 交付物，也应使用此技能。不要用于 PDF、电子表格、Google Docs，或与文档生成无关的一般编程任务。.
xlsx
Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or…
xlsx
当电子表格文件是主要输入或输出时使用此技能。这意味着用户想要：打开、读取、编辑或修复现有的 .xlsx、.xlsm、.csv 或 .tsv 文件（例如添加列、计算公式、格式化、制图、清理混乱数据）；从头创建新的电子表格或从其他数据源创建；或在表格文件格式之间进行转换。当用户通过名称或路径引用电子表格文件时特别触发——即使是随意提及（如"我下载目录里的 xlsx"）——并且想对其进行操作或从中生成内容。也适用于将混乱的表格数据文件（格式错误的行、错位的表头、垃圾数据）清理或重构为规范的电子表格。交付物必须是电子表格文件。当主要交付物是 Word 文档、HTML 报告、独立 Python 脚本、数据库管道或 Google Sheets…
dingtalk_channel_connect
Use a headed browser to automatically complete DingTalk channel integration for QwenPaw. Applicable when the user mentions DingTalk, developer console, Client ID, Client Secret, bot, Stream mode, binding or configuring a channel. Supports pausing when a login page is detected and resuming after the user logs in.
mailbox
当用户需要任何邮箱/邮件操作时使用此技能——包括查看、阅读、搜索、发送、回复、转发、整理或删除邮件，管理会话线程，绑定个人邮箱或注册新邮箱。此技能是邮件任务的统一且唯一入口，通过 qwenpawmail-mcp 编排操作，当前支持 9 个个人邮箱域名。.
Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and…