Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/smixs/agent-second-brainnpx agentmods add skills/smixs/agent-second-brain/migrate-doctorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/smixs/agent-second-brain/migrate-doctor)<a href="https://agentmods.dev/skills/smixs/agent-second-brain/migrate-doctor"><img src="https://agentmods.dev/badge/skills/smixs/agent-second-brain/migrate-doctor.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 32 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 47 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Privilege Escalation · line 28 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 44 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.00941 |
| Opus 5 | $0.00034 | $0.00470 |
| Sonnet 5 | $0.00014 | $0.00188 |
| Haiku 4.5 | $0.00007 | $0.00094 |
Grade B, and why
migrate-doctor scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo systemctl list-units 'd-brain-*' --all # legacy system-level How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Migrate Doctor
You are running INSIDE an interactive Claude Code session on the user's
server (subscription billing — this is the supported way to use AI for
repair). Your job: get a broken or half-migrated install to a healthy
v3.0 state. The deterministic path is bash upgrade.sh — your job is to
diagnose WHY it fails, remove the obstacle, and re-run it. Do not
re-implement the migration by hand unless upgrade.sh itself cannot work.
Known version layouts
| Version | Markers | Notes |
|---|---|---|
| v1 (Dec 2025) | system-level /etc/systemd/system/d-brain-bot.service, TODOIST_API_KEY in .env, mcp-config.json |
Todoist/MCP era, claude -p per message |
| v2 | d-brain-* units, claude -p/claude --print pipeline, weekly timer |
headless calls — dead after 2026-06-15 billing change |
| v3.0 (target) | dbrain-* systemd --user units, persistent tmux brain, ~/.dbrain/ runtime dir, cron subsystem |
interactive session on subscription |
Diagnosis checklist (read-only first)
# What's installed and running?
systemctl --user list-units 'dbrain-*' --all
sudo systemctl list-units 'd-brain-*' --all # legacy system-level
ls ~/.dbrain/ 2>/dev/null # runtime dir (v3)
tmux ls 2>/dev/null # brain sessions
git -C ~/projects/agent-second-brain log --oneline -3
cat ~/projects/agent-second-brain/.env | grep -v 'TOKEN\|KEY' # never print secrets
claude auth status --json # needs "loggedIn": true
journalctl --user -u dbrain-bot -n 50 --no-pager
Repair rules
- Backup before any destructive step:
tar czf ~/dbrain-backup-$(date +%s).tgz -C ~/projects agent-second-brain --exclude=.venvand note the current commit (git rev-parse HEAD). - Never modify or delete vault content (
vault/daily, notes, cards). The vault is the user's data; migration touches code, units and runtime files only. - Prefer re-running
bash upgrade.shafter each fix — it is idempotent. Fix the obstacle, not the symptom. - Typical obstacles and fixes:
- dirty git tree blocks
git pull --ff-only→git stash(show the user what was stashed) - legacy system-level units conflict →
sudo systemctl disable --now 'd-brain-*'and remove files from/etc/systemd/system/ loggedIn: false→ tell the user to runclaudeinteractively and log in; do NOT script OAuth- missing linger →
loginctl enable-linger $USER - stale
TODOIST_API_KEY/DBRAIN_MODElines in .env → remove them (v3 ignores but they confuse humans) - wedged brain session →
dbrain restartortmux kill-session -t <brain>(the bot recreates it lazily)
- dirty git tree blocks
- Report honestly: if a step failed, say so with the output. Never claim health you didn't verify.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 62 lines · 69 tokens per session scan B c511e2c4683e
migrate-doctor is a skill published in the GitHub repository smixs/agent-second-brain (365 stars, last pushed 1mo ago), licensed MIT. It adds 69 tokens to every session and 941 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
self-ops
Runtime self-diagnosis knowledge: database layout, observability APIs, timeout hierarchy, restart procedure, failure replay. Use when the user asks to debug this runtime itself — inspect its database, traces, prompt snapshots, timeouts, service health, or configuration.
code-review
A method for reviewing code, bugs, diffs, branches, and pull requests. A diff is the set of changes between two versions of code, and a pull request is a proposed change submitted for review.
graphlens-navigation
Navigate the code graph using graphlens MCP tools instead of reading files or grepping. Use when asked: "what calls X", "what breaks if I change X", "who uses this function", "what does this function depend on", "impact analysis", "find callers", "find references", "what implements/extends X", "what's in this file"…
memory-informed-debug
Debug with working memory -- before diagnosing, recall prior root causes and known-good diagnostic procedures; when a root cause is confirmed, capture it immediately. Use whenever debugging a non-trivial failure.
code-graphs
Build deterministic structure / dependency / call / entry-point-flow graphs from a repository's real code, with source-traceable file nodes and definitions. No invented nodes or edges; ambiguous references are flagged, not guessed.
governed-bug-fix
Fix a bug through GraQle's governed workflow — investigate with the knowledge graph, check blast radius, plan, generate a reviewed diff, and teach the outcome back to the graph. Use when fixing bugs in a repository that has a GraQle knowledge graph (graqle.json / graqle.yaml present) and the GraQle MCP server…