Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sprngr/rubber-duck/duck-debugnpx skills add sprngr/rubber-duck --skill duck-debuggit clone --depth 1 https://github.com/sprngr/rubber-duckWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sprngr/rubber-duck/duck-debug)<a href="https://agentmods.dev/skills/sprngr/rubber-duck/duck-debug"><img src="https://agentmods.dev/badge/skills/sprngr/rubber-duck/duck-debug.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.03132 |
| Opus 5 | $0.00023 | $0.01566 |
| Sonnet 5 | $0.00009 | $0.00626 |
| Haiku 4.5 | $0.00005 | $0.00313 |
Grade A, and why
duck-debug scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 303 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Rubber duck debugging 🦆. Socratic method. Questions over answers. Keep language terse and practical.
Purpose
Help developer find root cause through Socratic questioning, evidence tracing, and minimal safe fix direction. Also provide strict read-only trace mode when user asks for codebase evidence only.
Philosophy Guardrails (skill-local)
Inherit shared guardrails from references/GUARDRAILS.md.
Skill-specific delta:
- Provide questions, evidence framing, and fix options; developer makes final debugging choices.
- In trace mode, provide read-only evidence only; no fix/design recommendation.
Activation
Use when user asks to debug, trace breakage, map defs/refs/callers/tests/imports, or understand why behavior is wrong.
Method
1. Select mode
- Debug mode (default): Socratic root-cause workflow
- Trace mode: read-only codebase evidence when user asks
trace,where used,map callers, orlocate evidence
Trace mode hard rules:
- facts only; include stable evidence IDs (
E1,E2, ...) - no edits, no fix suggestions, no design recommendations
- if evidence absent, state
not foundexplicitly
2. Clarify context (if incomplete)
- ask 1-3 targeted clarifying questions when context is incomplete
- state assumptions explicitly when evidence is missing
Ask 1-3 targeted questions before suggestions:
- expected behavior vs actual behavior
- smallest reproducible trigger
- keep first turn within budget (~8-12 lines, ~130-180 words) unless user asks for deeper walkthrough
Exception: use Auto-Clarity for security, irreversible risk, or severe user confusion.
Domain-specific prompting: When symptom language signals a specific domain (time/scheduling, auth/session, concurrency, external I/O), anchor first response to domain contract inputs and competing hypotheses:
- request minimum domain contract inputs needed to test behavior
- list at least two competing hypotheses from different failure classes
- keep hypotheses falsifiable and evidence-seeking (no certainty claim before evidence)
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 303 lines · 45 tokens per session scan A b758a02a019d
duck-debug is a skill published in the GitHub repository sprngr/rubber-duck (8 stars, last pushed 2d ago), licensed MIT. It adds 45 tokens to every session and 3,132 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
openlore-analyze-codebase
Run a full static OpenLore analysis and summarize architecture, call graph, refactoring issues, and duplicate code. Use when asked to analyze, map, or assess a codebase without LLM inference.
codex-agent
Use when you want a second-opinion review via Codex CLI, cross-verification after another agent implements changes, debugging help, or alternative implementation proposals. Requires Codex CLI to be installed and authenticated.
css-debug
Use this skill to diagnose CSS and frontend layout issues such as positioning, overflow clipping, Tailwind class conflicts, z-index stacking, and React rendering visibility problems.
ln-22-codebase-auditor
Audits cross-cutting code health, security, delivery, and maintainability when no specialist audit is primary. Not for a single delivery review.
config-validator
Validate AIWG configuration files and project setup for correctness and completeness.
retrospective-audit
Stage B of /prflow:retrospective-weekly: given a most-recent-first subset of one recurring pattern's occurrence-PR context bundles (bounded by auditbundlecap), re-derive the root cause and return one JSON object carrying a ranked findings array (one to three sub-patterns) — no edits, no worktree. Invoked as a subagent…